Posted on

Paypal phishing attempt blocked

The phishing attemps are now blocked by the anti-spam gateway so they do no longer arrive in any of my mailboxes. Which, of course, is what it is the intended use, plus it allows a closer look to the message code without having the message actually delivered.

This one came in a few days ago:

<p><b><font face="Verdana" size="2">You are required to upgrade your PayPal
Account by subscribing to our New Security Center.</font></b></p>
<p><font face="Verdana" size="2">Please <b> <a href="http://202.67.156.66/www.paypal.com/cgi-bin/webscrcmd=_login-run/update.php">click here</a></b> in order to upgrade your PayPal account.</font></p>
<p><font face="Verdana" size="2">If you not perform the update now, your account will be placed on hold. On hold accounts can still send money, but they cannot withdraw or receive funds.</font></p>

Mind the hyperlink-address:

http://202.67.156.66/www.paypal.com/cgi-bin/webscrcmd=_login-run/update.php

This is NOT a paypal address.

PMAS signalled this – as is shown in the message header:


Received: from unknown ([72.54.216.109] EXTERNAL) (EHLO mail.iei-web.net) by
xxxxxxxxxxxxxxxxxxxx ([192.168.0.200]) (PreciseMail V3.0); Sun, 07 Oct
2007 06:41:42 +0100
Received: from User [62.14.249.101] by iei-web.net with ESMTP (SMTPD-9.10) id
A0F40294; Sat, 06 Oct 2007 23:39:00 -0600
Reply-To: <member_service@paypalsecurity.com>
From: "PayPal Inc."<member_service@paypalsecurity.com>
Subject: New Paypal Security Center: Update Your Account
Date: Sun, 7 Oct 2007 07:40:01 +0200
MIME-Version: 1.0
Content-Type: text/html; charset="Windows-1251"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000
Message-Id: <200710062339882.SM03048@User>

What are the findings:


X-PMAS-External: unknown [72.54.216.109] (EHLO mail.iei-web.net)
X-PMAS-Software: PreciseMail V3.0 [071006] (diana.GROOTERSNET.NL)
X-PMAS-DYN_URI-OK_URL: Dynamic URI check: OK URL (0.000)
X-PMAS-VMF-OK: Envelope FROM: check: Source accepts mail for address (0.000)

Quite well so far – except the “unknown” external address.
But now the problems show up:


X-PMAS-HDR-MISSING_HEADERS: Missing To: header (1.035)
X-PMAS-HDR-CTYPE_JUST_HTML: HTML-only mail, with no text version (1.500)
X-PMAS-HDR-RCVD_FROM_UNKNOWN: Message received from host without DNS entry (4.000)
X-PMAS-HDR-NO_SPACE_FROM: From: header is poorly formatted (no space) (5.000)
X-PMAS-URI-NORMAL_HTTP_TO_IP: Uses a dotted-decimal IP address in URL (0.942)
X-PMAS-URI-IP_LINK_PLUS: Dotted-decimal IP address followed by CGI (0.708)
X-PMAS-META-FORGED_OUTLOOK_HTML: Outlook can't send HTML message only (1.101)
X-PMAS-META-MISSING_BODY_TAG: Message has </BODY> tag, but no <BODY> tag (3.000)
X-PMAS-META-MISSING_HTML_TAG: Message has </HTML> tag, but no <HTML> tag (3.000)
X-PMAS-META-FORGED_OUTLOOK_TAGS: Outlook can't send HTML in this format (5.000)

You learn something new every day


X-PMAS-META-NO_HTML_BEGIN: Message has </html> but not <html> (3.500)
X-PMAS-META-PHISHING_01: Message is a phishing scam (50.000)
X-PMAS-META-PHISHING_03: Message appears to be a PayPal phishing scam (20.000)
X-PMAS-META-LAME_PAYPAL_SCAM: Claims to be from PayPal, but no PayPal URIs (20.000)

I thought so 🙂


X-PMAS-META-CLICK_BELOW: Asks you to click below (0.727)
X-PMAS-META-BLIND_DATE3: Blind date spam (3) (20.000)
X-PMAS-Final-Score: 139.513
X-PMAS-Spam-Level: ********************+
X-PMAS-Spam: Yes

Apart from what is unusual in Paypal: no addressing header (should use your Paypal name).

Posted on

Updating FORTRAN code

I’m in the process of porting code written on VAX in FORTRAN77 – and some routines have optional parameters. FORTRAN 77 cannot handle these, but on VAX, it’s easy to retrieve them using a small MACRO module. Not so on Alpha, and Itanium would be even more troublesome – if possible at all due to the architectural differences and processor technology. (See earlier thredas in this catergory).

So I have to choose: re-write the code in another language, or update it to a newer FORTRAN version that allows checking of arguments, as Hoff suggested.

I choose the latter – it proved a far less troublesome task than anticipated.

Consider a routine A, with 4 arguments K, L M and N. K being required and L, M and N optional; however, any of these could be present.

This is the basic FORTRAN 77 code:


SUBROUTINE A (K, L, M, N)

C arguments

INTEGER*4 K
INTEGER*4 L (*)
CHARACTER*(*) M
LOGICAL*4 N

C Local variables

INTEGER*4 S, nmbr, mask

C Routine used to see whether args are present
C Bits in Mask will be set when present

INTEGER*4 GETARGS

C main code

S = GETARGS (Nmbr, Mask)
...
IF (BTEST (Mask,2)) THEN
C
C Parameter L is present
C
ENDIF
....

This routine can be called as:

F = 1
G(1) = 1
G(2) = 1
G(3) = 1
H = "This can be a text of arbitrary length"
I = 0

CALL A (F,G,H,I)
CALL A (F,,H) ! so L and N are missing

Updating the routine to FORTRAN 95 so the optional parameters can be handled, are really minimal: add a line that specifies which arguments are optional, remove the call of the GETARG routine, and use PRESENT (arguments) in stead of BTEST(Mask, bit).
The FORTRAN95 code look like this:

SUBROUTINE A (K, L, M, N)

C arguments

INTEGER*4 K
INTEGER*4 L (*)
CHARACTER*(*) M
LOGICAL*4 N

OPTIONAL :: L, M, N

C Local variables

INTEGER*4 S

C main code

...
IF (PRESENT (L)) THEN
C
C Parameter L is present
C
ENDIF
....

To use this, the routine calling this subroutine must specify the interface. If a routine is heavily used, it’s worthwhile to create an INCLUDE file containing the interface:


INTERFACE
SUBROUTINE A (K, L, M, N)

C arguments

INTEGER*4 K
INTEGER*4 L (*)
CHARACTER*(*) M
LOGICAL*4 N

OPTIONAL :: L, M, N
END SUBROUTINE
END INTERFACE

Add this into calling routines:


INCLUDE 'A_IF.INC'
...
F = 1
G(1) = 1
G(2) = 1
G(3) = 1
H = "This can be a text of arbitrary length"
I = 0

CALL A (F,G,H,I)
CALL A (F,,H) ! so L and N are missing

This is still to be done, but it looks good!

I ran into one problem still to cope with:
CALL B (%VAL (Args))
does not compile: %VAL is out of context here.
The routine in which this code occurs is rather basic – and the mechanism is used heavily in calling routines, where the addresses of allocated memory are passed….
UPDATE
It turned out pretty straight forward. This particular reference turned out to be a parameter to a routine that could easily be bypassed by assigning the right value to a separate variable and use that one instead.

Well, all modules have been built now – except for the ones requiring a missing file but I don’t need that one in due time – and the libraries are created. Next is translating the macro containing the translation vectors into an option file, and vreate the shared image. Afther that, I can start creating the drivers to test it all

Posted on

14-Oct-2007

Persephone updated
Last week, a new version of Personal Alpha was released. Still a DEC3000 but enhanced to 128 Mb internal memory, and the full SRM console. This has been installed over the previous version, with some trouble: I should have de-installed it before installing the new one. This wasn’t mentioned! But after I did, the first invocation installed it and got it running. (Part of the issue was the relation between the .EMU extension and the assiciated program. Once that was solved, it’s all done)

PMAS crashed
One of the PMAS workers has crashed – I still have to check the logs ;(

%%%%%%%%%%% OPCOM 13-OCT-2007 12:02:51.30 %%%%%%%%%%%
Message from user SYSTEM on DIANA
%PTSMTP-E-WORKERDIED, worker PTSMTP 0001 (20200150) terminated unexpectedly
-SYSTEM-F-ACCVIO, access violation, reason mask=00, virtual address=000000000000FE79, PC=FFFFFFFF81F6CFC8, PS=0000001B
-PTSMTP-I-WORKERCONN, while processing connection from 86.57.187.251,2132

Perhaps because theer was something illegal from this site?

The main program was not effected so mail just went on. It’s just this connection.

Posted on

Another FTP script

Another FTP script
They come and go. There has been another attempt to access Diana as if it were a Windows or Linux box:

%%%%%%%%%%% OPCOM 10-OCT-2007 22:56:22.43 %%%%%%%%%%%
Message from user TCPIP$FTP on DIANA
User Name: anonymous
Source: s12.mgw-servers.de
Status: NOPRIV -- File access violation
Object: WEB_DISK2:[public.anonymous.071010235608p]

It took less than a minute.
The script starts with creating a directory – whci, of course, fails:

%TCPIP-I-FTP_SESCON, FTP SERVER: session connection from s12.mgw-servers.de at 10-OCT-2007 22:56:21.45
%TCPIP-I-FTP_NODE, client host name: s12.mgw-servers.de
%TCPIP-I-FTP_USER, user name: anonymous
%TCPIP-I-FTP_OBJ, object: WEB_DISK2:[public.anonymous.071010235608p]
%TCPIP-I-FTP_CHINFO, TCPIP$FTPC0000D: Failed to create directory
%SYSTEM-F-NOPRIV, insufficient privilege or object protection violation
%TCPIP-I-FTP_NODE, client host name: s12.mgw-servers.de

and next, a larger list of directories is accessed:

%TCPIP-I-FTP_USER, user name: anonymous
%TCPIP-I-FTP_OBJ, object: /incoming/
%TCPIP-I-FTP_OBJ, object: /upload/
%TCPIP-I-FTP_OBJ, object: /public/incoming/
%TCPIP-I-FTP_OBJ, object: /pub/incoming/
%TCPIP-I-FTP_OBJ, object: /_vti_pvt/
%TCPIP-I-FTP_OBJ, object: /_vti_txt/
%TCPIP-I-FTP_OBJ, object: /_vti_log/
%TCPIP-I-FTP_OBJ, object: /wwwroot/
%TCPIP-I-FTP_OBJ, object: /anonymous/
%TCPIP-I-FTP_OBJ, object: /public/
%TCPIP-I-FTP_OBJ, object: /pub/
%TCPIP-I-FTP_OBJ, object: /outgoing/
%TCPIP-I-FTP_OBJ, object: /temp/
%TCPIP-I-FTP_OBJ, object: /tmp/
%TCPIP-I-FTP_OBJ, object: /anonymous/_vti_pvt/
%TCPIP-I-FTP_OBJ, object: /anonymous/incoming/
%TCPIP-I-FTP_OBJ, object: /mailroot/
%TCPIP-I-FTP_OBJ, object: /ftproot/
%TCPIP-I-FTP_OBJ, object: /anonymous/pub/
%TCPIP-I-FTP_OBJ, object: /anonymous/public/
%TCPIP-I-FTP_OBJ, object: /_vti_cnf/
%TCPIP-I-FTP_OBJ, object: /anonymous/_vti_cnf/
%TCPIP-I-FTP_OBJ, object: /images/
%TCPIP-I-FTP_OBJ, object: /_private/
%TCPIP-I-FTP_OBJ, object: /cgi-bin/
%TCPIP-I-FTP_OBJ, object: /usr/
%TCPIP-I-FTP_OBJ, object: /usr/incoming/
%TCPIP-I-FTP_OBJ, object: /home/
%TCPIP-I-FTP_OBJ, object: /public_html/
%TCPIP-I-FTP_OBJ, object: /public_ftp/
%TCPIP-I-FTP_OBJ, object: /_vti_cnf/
%TCPIP-I-FTP_OBJ, object: /tagged/
%TCPIP-I-FTP_OBJ, object: / /
%TCPIP-I-FTP_OBJ, object: /%/
%TCPIP-I-FTP_OBJ, object: /data/
%TCPIP-I-FTP_OBJ, object: /inetpub/
%TCPIP-I-FTP_OBJ, object: /Tagged/
%TCPIP-I-FTP_OBJ, object: /TaGGeD/
%TCPIP-I-FTP_OBJ, object: /income/
%TCPIP-I-FTP_OBJ, object: /recieved/
%TCPIP-I-FTP_OBJ, object: /download/
%TCPIP-I-FTP_OBJ, object: /My Shared Folder/
%TCPIP-I-FTP_OBJ, object: /_kurdt/
%TCPIP-I-FTP_OBJ, object: /.htaccess/
%TCPIP-I-FTP_OBJ, object: /.private/
%TCPIP-I-FTP_OBJ, object: /~tmp/
%TCPIP-I-FTP_OBJ, object: /~temp/
%TCPIP-I-FTP_OBJ, object: /html/
%TCPIP-I-FTP_OBJ, object: /www/
%TCPIP-I-FTP_OBJ, object: /web/
%TCPIP-I-FTP_OBJ, object: /anonymous/_vti_txt/
%TCPIP-I-FTP_OBJ, object: /anonymous/_vti_log/
%TCPIP-I-FTP_OBJ, object: /anonymous/outgoing/
%TCPIP-I-FTP_OBJ, object: /mailroot/
%TCPIP-I-FTP_OBJ, object: /_private/
%TCPIP-I-FTP_OBJ, object: /_vti_cfg/
%TCPIP-I-FTP_OBJ, object: /site/
%TCPIP-I-FTP_OBJ, object: /page/
%TCPIP-I-FTP_OBJ, object: /ftp/
%TCPIP-I-FTP_OBJ, object: /new/
%TCPIP-I-FTP_OBJ, object: /root/
%TCPIP-I-FTP_OBJ, object: /stuff/
%TCPIP-I-FTP_OBJ, object: /dir/
%TCPIP-I-FTP_OBJ, object: /dirs/
%TCPIP-I-FTP_OBJ, object: /pass/
%TCPIP-I-FTP_OBJ, object: /log/
%TCPIP-I-FTP_OBJ, object: /folder/
%TCPIP-I-FTP_OBJ, object: /recycler/
%TCPIP-I-FTP_OBJ, object: /sql/
%TCPIP-I-FTP_OBJ, object: /MS_OFFICE2K/
%TCPIP-I-FTP_OBJ, object: /Printer Drivers/
%TCPIP-I-FTP_OBJ, object: /ww/
%TCPIP-I-FTP_OBJ, object: /webctrlsamp/
%TCPIP-I-FTP_OBJ, object: /web/
%TCPIP-I-FTP_OBJ, object: /bin/
%TCPIP-I-FTP_OBJ, object: /OFFICE/
%TCPIP-I-FTP_OBJ, object: /bilder/
%TCPIP-I-FTP_OBJ, object: /admin/
%TCPIP-I-FTP_OBJ, object: /file/
%TCPIP-I-FTP_OBJ, object: /img/
%TCPIP-I-FTP_OBJ, object: /logging/
%TCPIP-I-FTP_OBJ, object: /website/
%TCPIP-I-FTP_OBJ, object: /site/
%TCPIP-I-FTP_OBJ, object: /inetpub/wwwroot/
%TCPIP-I-FTP_OBJ, object: /inetpub/www/
%TCPIP-I-FTP_OBJ, object: /wwwroot/www/
%TCPIP-I-FTP_OBJ, object: /dump/
%TCPIP-I-FTP_OBJ, object: /de/
%TCPIP-I-FTP_OBJ, object: /sitedump/
%TCPIP-I-FTP_OBJ, object: /archives/
%TCPIP-I-FTP_OBJ, object: /WUTemp/
%TCPIP-I-FTP_OBJ, object: /win.asp/
%TCPIP-I-FTP_OBJ, object: /inetpub/
%TCPIP-I-FTP_OBJ, object: /en/
%TCPIP-I-FTP_OBJ, object: /lang/
%TCPIP-I-FTP_OBJ, object: /language/
%TCPIP-I-FTP_OBJ, object: /WinNT/
%TCPIP-I-FTP_OBJ, object: /WINDOWS/

All fail because of ” invalid directory syntax”
It might be that the script tries to PUSH data onto the system, not GET. The log does not mention it.
I tried the source. This seems to be a start-up company, stating to be (translated from German) “A company of today with the technology and know-how of tomorrow”. Their website isn’t ready yet.
Nor is their security.
If this is tomorrow’s technology and know-how, I have no confidence in it. My quite basic, 30-year old OpenVMS installation does a much better job without the fancy stuff.

I have signalled the attempt to them. Wait and seen what comes out of it.
UPDATE
I got a message stating it should be sent to their ABUSE address, so I did. From there, I got the message the message was forwarded to their customer. It might be genuine but what if that customer caused the problems?

Posted on

10-Oct-2007

MySQL crashed
… several times since I chnaged some system parameters.
First, immediately during startup (elapsed time half a minute) after first reboot:

071003 22:45:33 InnoDB: Starting log scan based on checkpoint at
InnoDB: log sequence number 0 38153825.
InnoDB: Doing recovery: scanned up to log sequence number 0 38153825
InnoDB: Last MySQL binlog file position 0 4, file name ./diana-bin.000011
071003 22:45:36 InnoDB: Flushing modified pages from the buffer pool...
071003 22:45:37 InnoDB: Started; log sequence number 0 38153825
071003 22:45:37 [ERROR] After InnoDB crash recovery, checking if the binary log
'./diana-bin.000011' contains rolled back transactions which must be removed from it...
/$116$DKA100/000000/WEB/MYSQL/MYSQL/VMS/BIN/mysqld.exe:
File './diana-bin.000011' not found (Errcode: 2)
071003 22:45:37 [ERROR] Could not open the binary log './diana-bin.000011' for truncation.
InnoDB: Error: tried to read 16384 bytes at offset 0 6012928.
InnoDB: Was only able to read -1.
071003 22:45:38 InnoDB: Operating system error number 12 in a file operation.
InnoDB: Error number 12 means 'not enough core'.
InnoDB: Some operating system error numbers are described at
InnoDB: http://dev.mysql.com/doc/mysql/en/Operating_System_error_codes.html
InnoDB: File operation call: 'read'.
InnoDB: Cannot continue operation.

After restart it crashed again during startup:

$ Set NoOn
$ VERIFY = F$VERIFY(F$TRNLNM("SYLOGIN_VERIFY"))
071003 23:03:41 InnoDB: Operating system error number 12 in a file operation.
InnoDB: Error number 12 means 'not enough core'.
InnoDB: Some operating system error numbers are described at
InnoDB: http://dev.mysql.com/doc/mysql/en/Operating_System_error_codes.html
InnoDB: File name /database/mysql41/ibdata1
InnoDB: File operation call: 'create'.
InnoDB: Cannot continue operation.

I restarted it once again, and next, the server ran for almost 4 days and crahed – again:

%CMA-F-EXIT_THREAD, current thread has been requested to exit
%TRACE-F-TRACEBACK, symbolic stack dump follows
image module routine line rel PC abs PC
InnoDB: Thread 117396224 stopped in file MYSQL_ROOT:[innobase.include]sync0sync
%SYSTEM-F-ACCVIO, access violation, reason mask=00, virtual address=00000000000
%TRACE-F-TRACEBACK, symbolic stack dump follows
image module routine line rel PC abs PC
PTHREAD$RTL 0 000000000004381C FFFFFFFF81E6181C
PTHREAD$RTL 0 000000000006EB58 FFFFFFFF81E8CB58
0 FFFFFFFF8016EFB4 FFFFFFFF8016EFB4
0 FFFFFFFF80376E0C FFFFFFFF80376E0C
DECC$SHR_EV56 0 00000000001D2DC4 FFFFFFFF82066DC4
DECC$SHR_EV56 0 00000000001D2A8C FFFFFFFF82066A8C
0 FFFFFFFF8018776C FFFFFFFF8018776C
0 FFFFFFFF8018776C FFFFFFFF8018776C
—– above condition handler called with exception 0000000C:
%SYSTEM-F-ACCVIO, access violation, reason mask=00, virtual address=00000000000
—– end of exception message
0 FFFFFFFF800A911C FFFFFFFF800A911C
DECC$SHR_EV56 0 0000000000108364 FFFFFFFF81F9C364
DECC$SHR_EV56 0 0000000000108560 FFFFFFFF81F9C560
DECC$SHR_EV56 0 0000000000142D74 FFFFFFFF81FD6D74
DECC$SHR_EV56 0 0000000000142118 FFFFFFFF81FD6118
DECC$SHR_EV56 0 000000000013BBA4 FFFFFFFF81FCFBA4
InnoDB: Thread 87978752 stopped in file MYSQL_ROOT:[innobase.include]sync0sync.
mysqld MY_PTHREAD sigwait 23808 0000000000000408 00000000003C5108
mysqld OS0FILE os_aio_simulated_handle
36642 0000000000005AB4 00000000002CE344
InnoDB: Thread 87929600 stopped in file MYSQL_ROOT:[innobase.os]os0sync.c;1 lin
mysqld mysqld signal_hand 86616 0000000000002AE8 0000000000232AE8
PTHREAD$RTL 0 000000000005773C FFFFFFFF81E7573C
PTHREAD$RTL 0 0000000000043940 FFFFFFFF81E61940
0 0000000000000000 0000000000000000
PTHREAD$RTL ? ?
0 FFFFFFFF80377CE4 FFFFFFFF80377CE4
%TRACE-I-END, end of TRACE stack dump
mysqld FIL0FIL fil_aio_wait 45034 000000000000E80C 000000000028D12C
mysqld SRV0START io_handler_thread 57590 00000000000009D4 0000000000317984
PTHREAD$RTL 0 000000000005773C FFFFFFFF81E7573C
PTHREAD$RTL 0 0000000000043940 FFFFFFFF81E61940
0 0000000000000000 0000000000000000
PTHREAD$RTL ? ?
0 FFFFFFFF80377CE4 FFFFFFFF80377CE4
%TRACE-I-END, end of TRACE stack dump
%CMA-F-EXIT_THREAD, current thread has been requested to exit

InnoDB: Thread 87929600 stopped in file MYSQL_ROOT:[innobase.os]os0sync.c;1 line 501
InnoDB: Thread 87978752 stopped in file MYSQL_ROOT:[innobase.include]sync0sync.ic;1 line 111
%CMA-F-EXIT_THREAD, current thread has been requested to exit
%TRACE-F-TRACEBACK, symbolic stack dump follows
image module routine line rel PC abs PC
PTHREAD$RTL 0 000000000004381C FFFFFFFF81E6181C
PTHREAD$RTL 0 000000000006EB58 FFFFFFFF81E8CB58
0 FFFFFFFF8016EFB4 FFFFFFFF8016EFB4
0 FFFFFFFF80376E0C FFFFFFFF80376E0C
DECC$SHR_EV56 0 00000000001D2DC4 FFFFFFFF82066DC4
DECC$SHR_EV56 0 00000000001D2A8C FFFFFFFF82066A8C
0 FFFFFFFF8018776C FFFFFFFF8018776C
0 FFFFFFFF8018776C FFFFFFFF8018776C
—– above condition handler called with exception 0000000C:
%SYSTEM-F-ACCVIO, access violation, reason mask=00, virtual address=0000000000000000, PC=000000000028CDE4, PS=0000001B
—– end of exception message
0 FFFFFFFF800A911C FFFFFFFF800A911C
mysqld FIL0FIL fil_io 44926 000000000000E4C4 000000000028CDE4

and the last one happend yesterday:

InnoDB: Thread 87929600 stopped in file MYSQL_ROOT:[innobase.os]os0sync.c;1 lin
InnoDB: Thread 87978752 stopped in file MYSQL_ROOT:[innobase.include]sync0sync.
%CMA-F-EXIT_THREAD, current thread has been requested to exit
%TRACE-F-TRACEBACK, symbolic stack dump follows
image module routine line rel PC abs PC
PTHREAD$RTL 0 000000000004381C FFFFFFFF81E6181C
PTHREAD$RTL 0 000000000006EB58 FFFFFFFF81E8CB58
0 FFFFFFFF8016EFB4 FFFFFFFF8016EFB4
0 FFFFFFFF80376E0C FFFFFFFF80376E0C
DECC$SHR_EV56 0 00000000001D2DC4 FFFFFFFF82066DC4
DECC$SHR_EV56 0 00000000001D2A8C FFFFFFFF82066A8C
0 FFFFFFFF8018776C FFFFFFFF8018776C
0 FFFFFFFF8018776C FFFFFFFF8018776C
----- above condition handler called with exception 0000000C:
%SYSTEM-F-ACCVIO, access violation, reason mask=00, virtual address=00000000000
----- end of exception message
0 FFFFFFFF800A911C FFFFFFFF800A911C
mysqld FIL0FIL fil_io 44926 000000000000E4C4 000000000028CDE4

The first ones may have to do with the IDE server of Distributed Netbeans running: there might indeed have been too little memory, all consumed by that stuff.
The last ones may have been the result of the WEBES issues – again, a set of JAVA programs consuming lots of memory.

Keep the fingers crossed….

PHP problems
It’s not just MySQL. PHP suffers of access problems as well since these changes: complains of files that cannot be opened, and on second invocation, nothing is wrong…

I’ll have to reconsider the cahnges and eventually turn them back – bit on the other hand, I may need at least some of the resources when RdB is installed.