Xref: utzoo unix-pc.general:1883 comp.sys.att:4954
Path: utzoo!utgpu!watmath!uunet!ukma!mailrus!cornell!uw-beaver!fluke!vince
From: vince@tc.fluke.COM (Craig Johnson)
Newsgroups: unix-pc.general,comp.sys.att
Subject: ubluit exists
Message-ID: <6348@fluke.COM>
Date: 17 Dec 88 02:00:15 GMT
Sender: news@tc.fluke.COM
Organization: John Fluke Mfg. Co., Inc., Everett, WA
Lines: 55

Somebody in this newsgroup mentioned he saw a message containing
"ubluit" just before his system died a horrible death.  He wanted to
know whether this was an indication of some prankster getting into his
system.

I can't give you any answers, but I have turned up an interesting
clue.  I happened to run strings on /usr/ucb/mail on my Sun 3/50 (BSD
4.2, Sun 3.5.2) today and what should appear in the output but
*ubluit*!  Here it is in the context of the strings output:

	sendmail
	/usr/lib/sendmail
	sendwait
	Should be inserting commas in recip lists
	To: 
	Subject: %s
	Cc: 
	Bcc: 
	    
	save in '%s'
	@(#)stralloc.c 1.2 86/10/08 SMI
	String too large
	No room for space %d
	Internal error
	@(#)temp.c 1.2 86/10/08 SMI
	/tmp/Rs%-d
	/tmp/Rq%-d
	/tmp/Rm%-d
	/tmp/Re%-d
	/tmp/Rx%-d
	/tmp/Rz%-d
	"%s" is not a user of this system
-->	ubluit
	Who are you!?
	@(#)tty.c 1.2 86/10/08 SMI
	gtty
	Subject: 
	too long to edit
	@(#)vars.c 1.2 86/10/08 SMI
	prompt
	assign(%s)=%s
	"%s": undefined variable
	deassign(%s)
	Out of memory
	value(%s)=%s
	"%s": not a group

I don't know if this will do you a bit of good, but it does provide
evidence that it was not a prankster who did you in.  Perhaps you can
rest easier now.  Good luck getting your system back up.


	Craig V. Johnson		...!fluke!vince
	John Fluke Mfg. Co.
	Everett, WA