1098 lines
52 KiB
Plaintext
1098 lines
52 KiB
Plaintext
=========================================================================
|
|
||
|
|
From the files of The Hack Squad: || by Lee Jackson, Co-Moderator,
|
|
|| FidoNet International Echo SHAREWRE
|
|
The Hack Report || Volume 2, Number 3
|
|
for March, 1993 || Report Date: March 7, 1993
|
|
||
|
|
=========================================================================
|
|
|
|
Welcome to the third 1993 issue of The Hack Report. This is a series of
|
|
reports that aim to help all users of files found on BBSs avoid
|
|
fraudulent programs, and is presented as a free public service by the
|
|
FidoNet International Shareware Echo and the author of the report, Lee
|
|
Jackson (FidoNet 1:382/95).
|
|
|
|
This month, another commercial software company contacts your Hack Squad,
|
|
and several new Trojans rear their ugly heads. Also, this issue
|
|
introduces some minor formatting changes and an addition to the archive
|
|
version: an internal archive with the full text of file tests performed
|
|
this year. Thanks to everyone who has helped put this report together,
|
|
and to those that have sent in comments and suggestions.
|
|
|
|
NOTE TO SYSOPS: The Hack Report may be freely posted as a bulletin on
|
|
your BBS, subject to these conditions:
|
|
|
|
1) the latest version is used,
|
|
2) it is posted in its entirety, and
|
|
3) it is not altered in any way.
|
|
|
|
NOTE TO OTHER READERS: The Hack Report (file version) may be freely
|
|
uploaded to any BBS, subject to the above conditions, and only if you do
|
|
not change the filename. You may convert the archive type as you wish,
|
|
but please leave the filename in its original HACK????.* format. The
|
|
Hack Report may also be cross-posted in other networks (with the
|
|
permission of the other network) as long as it meets the above conditions
|
|
and you give appropriate credit to the FidoNet International Shareware
|
|
Echo (and the author <g>).
|
|
|
|
The idea is to make this information available freely. However, please
|
|
don't cut out the disclaimers and other information if you use it, or
|
|
confuse the issue by spreading the file under different names. Thanks!
|
|
|
|
DISCLAIMER: The listings of Official Versions are not a guarantee of the
|
|
files' safety or fitness for use. Someone out there might just be
|
|
sick-minded enough to upload a Trojan with an "official" file name, so
|
|
>scan everything you download<!!! The author of this report will not be
|
|
responsible for any damage to any system caused by the programs listed as
|
|
Official Versions, or by anything using the name of an Official Version.
|
|
|
|
*************************************************************************
|
|
|
|
Hacked Programs
|
|
|
|
Here are the latest versions of some programs known to have hacked copies
|
|
floating around. Archive names are listed when known, along with the
|
|
person who reported the fraud (thanks from us all!).
|
|
|
|
Program Hack(s) Latest Official Version
|
|
======= ======= =======================
|
|
| ARJ Archiver ARJ250 ARJ239C (* - see note)
|
|
| Reported By: Tommy Vielkanowitz(1:151/2305)
|
|
| ARJ240A
|
|
| Reported By: Ryan Shaw (1:152/38)
|
|
|
|
| Blue Wave Offline BWAVE_3 BWAVE212
|
|
| Mail Reader
|
|
| Reported By: HW Scott Raymond
|
|
|
|
BNU FOSSIL Driver BNU202 BNU170
|
|
Reported By: Amauty Lambrecht (2:291/712) (not counting betas)
|
|
BNU188B
|
|
Reported By: David Nugent (3:632/348),
|
|
Author of BNU
|
|
|
|
| F-Prot Virus Scanner FP-205B FP-207
|
|
Reported By: Bill Lambdin (1:343/45)
|
|
|
|
LhA Amiga Archiver LHA148E LHA138E (Shareware)
|
|
Reported By: Michael Arends (1:343/54) LHA v1.50r (Regist.)
|
|
LHA151
|
|
Reported By: Lawrence Chen (1:134/3002)
|
|
|
|
| MusicPlay MPLAY31 MPLAY25B
|
|
| Reported By: Lee Madajczyk (1:280/5)
|
|
|
|
PKLite PKLTE201 PKL115
|
|
Reported By: Wen-Chung Wu (1:102/342)
|
|
|
|
| PKZip PKZ301 PKZ204G
|
|
Reported By: Mark Dudley (1:3612/601)
|
|
Jon Grimes (1:104/332)
|
|
|
|
|
|
| Shez SHEZ72A SHEZ87
|
|
SHEZ73
|
|
Reported By: Bill Lambdin (1:343/45)
|
|
|
|
|
|
Telix Telix v3.20 TLX320-1
|
|
(Prior to Dec. 1992) TLX320-2
|
|
Telix v3.25 TLX320-3
|
|
Reported By: Brian C. Blad (1:114/107) TLX320-4
|
|
Peter Kirn (WildNet, via
|
|
Ken Whiton)
|
|
Telix v4.00
|
|
Telix v4.15
|
|
Reported By: Barry Bryan (1:370/70)
|
|
Telix v4.25
|
|
Reported By: Daniel Zuck (2:247/30, via Chris
|
|
Lueders (2:241/5306.1)
|
|
MegaTelix
|
|
Verified By Jeff Woods, deltaComm, Inc.
|
|
Please Note - the 3.20 release dated either December 10th
|
|
or December 14th, 1992, is legitimate: any earlier file
|
|
calling itself v3.20 and carrying an Exis, Inc. trademark
|
|
is not legitimate. Please thoroughly check your version
|
|
prior to sending questions to this reporter! <g>
|
|
Telix Pro
|
|
Reported By: Jason Engebretson (1:114/36),
|
|
in the FidoNet TELIX echo
|
|
|
|
Wolfenstein-3D WOLF2-1 #1WOLF14
|
|
WOLF2-2
|
|
Reported By: Wen-Chung Wu (1:102/342)
|
|
|
|
|
|
| * - Quick break with tradition: by the time you read this,
|
|
| ARJ239D may have been released. Robert Jung has announced
|
|
| that this is a bug fix to the current pre-release, ARJ239C.
|
|
|
|
=========================================================================
|
|
|
|
Hoax Alert:
|
|
|
|
| This isn't a program hoax, but it concerns a company that most folks know
|
|
| of. You might want to see this.
|
|
|
|
|
| A letter/text file/message has entered distribution, claiming that PKWare
|
|
| Inc. has filed for Chapter 11 bankruptcy. The letter is dated Friday,
|
|
| February 26, 1993, and supposedly quotes Mark Gresbach of PKWare in the
|
|
| statement.
|
|
|
|
|
| However, in a message posted in the CompuServe PKWARE forum on March 1,
|
|
| 1993, PKWare employee Douglas Hay states that this is not true. Douglas
|
|
| also points out that the perpetrator of the hoax misspelled the word
|
|
| Milwaukee (as 'Milwaukie'), and that one of the three phone numbers in
|
|
| the message for PKWare is wrong. In short, ignore the letter - PKWare
|
|
| has _not_ filed bankruptcy.
|
|
|
|
|
|
Other previously reported hoaxes:
|
|
|
|
Filename Claimed use/Actual activity/Reporter(s)
|
|
============ ==========================================================
|
|
PKZ305 Hacked "new version" of PKZip. However, a message in wide
|
|
circulation claimed this was infected with a virus called
|
|
PROTO-T. This message is the actual hoax: there may be
|
|
one or more PROTO-T viruses around now, but none do what
|
|
was claimed in the hoax message. This hack, PKZ305, was
|
|
not infected with any virus, nor did it contain Trojan
|
|
code, per testing by Bill Logan (1:300/22), Jeff White
|
|
(1:300/23), and Bill Lambdin (1:343/45).
|
|
|
|
RAOPT "Optimizes" your RemoteAccess BBS files and claims to be
|
|
from Continental Software. Actually does nothing but read
|
|
your USERS.BBS file and report the number of users. The
|
|
program is _not_ from Continental Software, according to
|
|
Andrew Milner. Reported by Kai Sundren (2:201/150), via
|
|
HW Mikael Winterkvist.
|
|
|
|
SCORCHV2 Claims to be v2.0 of the game Scorched Earth: this version
|
|
doesn't yet exist. Actually a renamed archive of version
|
|
1.2. Reported by Brian Dhatt (1:3648/2.5).
|
|
|
|
=========================================================================
|
|
|
|
The Trojan Wars
|
|
|
|
Trojan writers seem to be getting a bit trickier with their code lately -
|
|
two of this month's reports involve "multipartite Trojans," or Trojans
|
|
whose code is split among two or more files and reassembled by a "clean"
|
|
program. In honor of this, I recommend that you grab a Banana Split,
|
|
cover your keyboard, and read on.
|
|
|
|
|
|
| Last month's issue included a report on a "fix" for PKZip v2.04c (yes, I
|
|
| mean 2.04c this time) that corrected the -$ (store disk volume) bug. The
|
|
| bulk of the report came from Jeff White of The Pueblo Group in Tuscon,
|
|
| Arizona, and had reference to some suspicious code in the file.
|
|
|
|
|
| The biggest question brought up by the test concerned the following code:
|
|
|
|
|
| Address: 0000d0e0-0000d110
|
|
| Code: x:/ x: *.* / Erasing contents of drive, completed.
|
|
|
|
|
| I have received a message from a user whose name I no longer have on file
|
|
| (please forgive me - NetMail me and I'll add your name to the report!)
|
|
| which states that this same text string can be seen within legitimate
|
|
| versions of PKZip (both v2.04e and the latest, v2.04g). It can't be seen
|
|
| by using a file/hex viewer, but it can be seen if the code is debugged,
|
|
| and only after the program has un-PKLited itself.
|
|
|
|
|
| *** EDITOR'S NOTE - I need to state that this is not something that I
|
|
| encourage, since many shareware licenses state that debugging,
|
|
| disassembly, and/or reverse engineering is not allowed. However,
|
|
| hopefully the folks at PKWare won't mind this bit of software sleuthing,
|
|
| since it is in their best interest to get to the heart of this matter.
|
|
|
|
|
| If you want to see the full text of the test results on this, see the
|
|
| file PKZIPFIX.RES in the archive FILETSTS.LZH, included in the archive
|
|
| version of The Hack Report.
|
|
|
|
|
| As always, our thanks go out to Bill and Jeff for their invaluable help.
|
|
|
|
|
|
William Gordon (1:369/104) reports BEV105, a file that claims to be a
|
|
"Beverly Hills 90210 Adventure Game." This file contains 8 files, but
|
|
two seem to be the real culprits: DORINFO.DIR and INSTALL.COM. The
|
|
installation renames the DORINFO.DIR file to IDCKILL.EXE and invokes it.
|
|
This program asks for some sort of wildcard according to William, then
|
|
proceeds to delete everything on your drive that matches that wildcard.
|
|
However, it doesn't stop there: it continues on and deletes all .bat,
|
|
.fon, .com, .zip, .sys, .ice, .ans, .arj, and .exe files. William also
|
|
says the file "comes with the following virii: Bootkill and Genesis."
|
|
|
|
| A copy of this file was sent to Mr. White and Mr. Logan, who were able to
|
|
| confirm the behaviour that William reported. For the complete results of
|
|
| their test, see the file BEV105.RES in the FILETSTS.LZH archive, included
|
|
| in the archive version of The Hack Report.
|
|
|
|
|
|
| Bill Lambdin (1:343/45) forwards a message from Terry Goodman in the U'NI
|
|
| Net virus conference concerning the file SCOMP. This was advertised as a
|
|
| compression utility with better compression than PKZip. The file passes
|
|
| all virus checkers unless you also check data files in addition to
|
|
| executables. In short, the executable loads a file called SCOMP.DAT,
|
|
| which it uses to create a file called CASPER.COM, which is apparently the
|
|
| Casper virus.
|
|
|
|
|
|
| Another report from Bill concerns a file he located called TAXTIP93.
|
|
| This archive contains a file called TAXTIP93.DAT, which the executable
|
|
| file, TAXTIPS.EXE, renames to MOUSE.COM and tries to copy to your DOS and
|
|
| WINDOWS directory. The new MOUSE.COM is infected with the ADA virus.
|
|
|
|
|
|
| Brian Chan (Internet, chanav@sfu.ca) found a file called PASSPRO, which
|
|
| was described with a very short line ("'Password,' or some other short
|
|
| word," according to Brian). The archive contained these files:
|
|
|
|
|
| PASS .PA1
|
|
| PASS .PA2
|
|
| PASS .PA3
|
|
| PASSWORD.COM
|
|
|
|
|
| Brian looked inside the .com file, which he says looks like a compiled
|
|
| batch file, and found these strings/commands:
|
|
|
|
|
| Please Wait While Loading;
|
|
| It may take in between 30seconds to 5 minutes
|
|
| To unshrink nessessary files
|
|
| Please Turn off Screen, and wait for the beep.
|
|
| If You do not, your screen might not function
|
|
| the way it should.
|
|
| Turn Off Screen now, and press the space bar.
|
|
|
|
|
| /C REN pass.pa1 pa.exe
|
|
| pass.pa2 /C DEL c:\*.*
|
|
| pass.pa2 /C DEL c:\dos\*.*
|
|
| /C REN pa.exe pass.pa1
|
|
| pass.pa3 FORMAT
|
|
| c:
|
|
| /C CLS
|
|
|
|
|
| As you can see, PASS.PA1 gets renamed to PA.EXE - the file, compressed
|
|
| with PKLite, is actually Microsoft's MS-DOS ATTRIB.EXE program. PASS.PA2
|
|
| contains the single letter 'Y', and PASS.PA3 contains the single word
|
|
| 'Yes'. From the looks of things, this turns out to be a multipartite
|
|
| Trojan that attempts to format (what else?) your hard drive.
|
|
|
|
|
|
| Another multipartite Trojan was spotted by James Frazee (1:343/58), under
|
|
| the filename ADD_IT. It contains these files:
|
|
|
|
|
| Name of File Size Date
|
|
| ADD_IT.ARJ 40888 02-11-93
|
|
| =======================================
|
|
| ADDIT1 DAT 34283 07-20-91 2:13a
|
|
| ADD_IT ANS 646 02-11-93 8:31p
|
|
| ADDIT2 DAT 20634 04-09-91 5:00a
|
|
| ADDIT DOC 177 02-11-93 7:28p
|
|
| ADDIT COM 1391 02-11-93 8:14p
|
|
| ADDIT3 DAT 138 02-11-93 8:13p
|
|
| THEDRAW PCK 650 02-11-93 8:31p
|
|
|
|
|
| When run, ADDIT.COM merges the three .DAT files into an .EXE file. The
|
|
| end result was that the program deleted all of the files in the directory
|
|
| in which it was run.
|
|
|
|
|
|
| Matt Hargett (1:2430/1532) found a file called DRSLEEP which he says has
|
|
| a "cheap virii (sic) in it," but actually appears to be a Trojan. When
|
|
| the executable, DRSLEEP.EXE is run, it deletes your COMMAND.COM file.
|
|
| Not much to write home about, but nasty enough. Thanks, Matt.
|
|
|
|
|
|
| Brent Thomas (1:202/226) says in the FidoNet DIRTY_DOZEN echo that his
|
|
| system was "taken down" by a file called DRAGON. It claimed to be a
|
|
| Public Domain VGA and Sound Blaster supported game. No symptoms were
|
|
| reported, except that he had to reformat his hard drive.
|
|
|
|
|
|
| Josh Burke (1:138/174) reports, via Charlie Sheridan (1:356/18), Travis
|
|
| Griggs (1:3807/8), and HW Bob Seaborn, a problem with the file PHYLOX2.
|
|
| In what might be an isolated incident, Josh says the file claimed to be a
|
|
| "really cool game, VGA gfx and SB sound." However, the INSTALL program
|
|
| destroys hard disks.
|
|
|
|
|
| Bob Seaborn received a copy of this file and forwarded it to me - as soon
|
|
| as possible, I will try to get it tested to see just exactly what it
|
|
| does.
|
|
|
|
|
|
| John Balkunas (1:107/639) forwards information on GIFCHECK. He reports
|
|
| that Lance Merlen (1:107/614) received an upload of this file, which,
|
|
| when checked with McAfee's ViruScan v100, reported over 5 viruses in the
|
|
| files in the archive. No internal archive data was provided, so it is
|
|
| hard to say whether or not this is an isolated incident.
|
|
|
|
|
|
Zack Jones (1:387/641) reports a file called GAGS which was seen in the
|
|
San Antonio area. The file, described as "Some Christmas practical
|
|
jokes," was analyzed by Bill Dirks (1:385/17) and confirmed as a Trojan.
|
|
The program grabs control of several interrupt vectors, including the
|
|
critical error handler. The only way to stop it once it starts is to hit
|
|
the reset button or power down.
|
|
|
|
When invoked, it displays a countdown from 8 to 0, which corresponds to
|
|
drives H through A, in that order. For each found drive, it overwrites
|
|
the first 255 sectors with random data from a block of memory. To add
|
|
insult to injury, if drives B and A are empty, you are prompted to insert
|
|
disks (so that they can be trashed as well).
|
|
|
|
After this, the Trojan displays the message, including something like,
|
|
"the disk was trashed but it's only a joke and they are only kidding."
|
|
It then prompts you to reboot, which is rather hard to do unless you have
|
|
a bootable "panic disk" floppy on hand - you certainly won't be able to
|
|
boot from your HD.
|
|
|
|
Bill says that if your HD is smaller than 60 megs, you're better off
|
|
trying to recover your disk from scratch. Between 60-120 megs, you have
|
|
a better chance of recovery via disk utilities: over 120 megs, you
|
|
should be able to accomplish a complete recovery if you're careful and
|
|
you know what you're doing.
|
|
|
|
Bill posted the following scan string that can be used to detect this
|
|
Trojan - if your scanner can use external strings, be sure to read the
|
|
instructions carefully before trying to add this:
|
|
|
|
9A46027205B003B9FF00BA0000CD26
|
|
|
|
If your scanner requires a name for the string, Bill suggests using
|
|
"AlamoXmasTrojan."
|
|
|
|
|
|
This Trojan report comes from an article in MacWeek magazine, Volume 7,
|
|
Number 2, issued January 11, 1993. The article, posted in the FidoNet
|
|
VIRUS_INFO echo by Robert Cummings, states that a program called CPro
|
|
1.41.sea, claiming to be a new version of Compact Pro (a Macintosh
|
|
shareware compression utility), will reformat any floppy in drive 1 and
|
|
tries to reformat the user's start-up hard drive when launched.
|
|
|
|
The file can be identified by a 312K sound resource file called "log
|
|
jingle," which is digitized sound from the Ren and Stimpy cartoons.
|
|
|
|
|
|
Mike Wenthold (1:271/47) found a program under the filename GS2000 which
|
|
contained the VCL 3 [Con] Virus. I am attempting to get further details
|
|
on what this file is, but until then, here is the archive data that Mike
|
|
sent:
|
|
|
|
Length Method Size CF Date Time CRC Filename
|
|
======== ======== ======== ==== ========= ====== ======== ============
|
|
1984 1304 34% 22-Dec-91 01:40p 3527B16B GS2000.COM
|
|
543 363 33% 22-Dec-91 01:58p DB83A2C0 GSUNP.DOC
|
|
======== ======== ======== ==== ========= ====== ======== ============
|
|
2527 1667 34% 2 files.
|
|
|
|
The compression method (on this ZIP archive) was not included in his
|
|
data.
|
|
|
|
|
|
Frans Hagelaars (2:512/2) has posted a message in several echos
|
|
concerning a Trojan version of the Blue Wave Offline Mail Reader that had
|
|
been circulating in his area. According to the warning, the "hacked"
|
|
version attacks your hard drive boot sector and partition table, and will
|
|
then "play tricks" with RemoteAccess userlists and phone numbers.
|
|
|
|
The filename of this version was not given in the report, nor was it made
|
|
clear whether the BBS door or the Reader was involved. If you have any
|
|
questions about the security of your copy, remember that you can always
|
|
obtain a safe copy from the BBS of the author, George Hatchew, at FidoNet
|
|
address 1:2240/176, phone number 1-313-743-8464, or from any of the
|
|
official distribution sites (which I believe are listed in the
|
|
documentation for the program).
|
|
|
|
|
|
Filename Claimed use/Actual activity/Reporter(s)
|
|
======== ==============================================================
|
|
AANSI100 Claims to add Auto-ANSI detect to Telegard BBSs - contains
|
|
something called the "Malhavoc Trojan," which displays a verse
|
|
from a Toronto band and attacks files/sectors on drives C:
|
|
through F:. Reported by HW Todd Clayton and by George Goode
|
|
(1:229/15).
|
|
|
|
ANSISCR VGA BBS ad - contains a self-extracting archive of the Yankee
|
|
Doodle and AntiChrist viruses. Can trash hard drives as well
|
|
through Trojan behaviour. Reported by Bill Dirks (1:385/17),
|
|
and under the filename RUNME by Stephen Furness (1:163/273).
|
|
|
|
AVENGER Advertised as an "amazing game that supports all kind of sound
|
|
cards...." Contains 2 internal password-protected .ZIP format
|
|
files, AVENGER2.DAT and AVENGER3.DAT, which are expanded by
|
|
the program to the files RUNTIME1.COM (N1 virus) and
|
|
RUNTIME2.COM (Anthrax virus). From Reinhardt Mueller, via
|
|
Bill Lambdin (1:343/45).
|
|
|
|
BATMAN No claim reported - searches your DOS path and tries to "delete
|
|
the executable file that loads WildCat BBSs." Reported by
|
|
James Powell (Intelec PC-Security Conference), via Bill Lambdin
|
|
(1:343/45).
|
|
|
|
CHROME Possible isolated incident - contains a file, FGDS.COM, which
|
|
contains text that says "Skism Rythem Stack Virus-808."
|
|
Reported by Richard Meyers and forwarded by Larry Dingethal
|
|
(1:273/231).
|
|
|
|
DBSOUND Possible isolated incident - claimed update of the Drum
|
|
Blaster .MOD file player. Deletes all files in the current
|
|
directory and all of its subdirectories. From "Khamsin #1
|
|
@9168*1", forwarded by HW Ken Whiton and HW Bill Dennison,
|
|
from Ken Green of the CentraLink BBS.
|
|
|
|
GRAFIX Possible isolated incident - contains the file WAIT.COM, which
|
|
is a renamed copy of DELDIR.COM, a directory remover and file
|
|
deletion tool. Reported by Andreas Reinicke (2:284/402).
|
|
|
|
LOGIM613 Possible isolated incident - one internal file, MOUSE.COM,
|
|
reports as being infected with the VCL virus when checked with
|
|
McAfee's ViruScan v95. Reported by Mike Wenthold (1:271/47).
|
|
|
|
MUVBACK Claimed keyboard utility - actual ANSI bomb that remaps the D
|
|
key of your keyboard to invoke DEBUG and create a couple of
|
|
Trojans from script files. Reported by Bill Dirks.
|
|
|
|
OPTIBBS Aimed at RemoteAccess BBS systems - archives your USERS.BBS
|
|
list and places it in your download directory. Reported by
|
|
HW Nemrod Kedem.
|
|
|
|
QOUTES Not a misspelling - claimed Christmas quotation generator.
|
|
Overwrites the first 128 cylinders of your first HD, requiring
|
|
a low level format to overcome the damage (IDE drives may need
|
|
to go back to the factory). Reported by Gary Marden
|
|
(2:258/27).
|
|
|
|
QSCAN20 Claimed small virus scanner - when run, identifies itself as
|
|
"being a stealth bomber" and attacks your hard drive's FAT.
|
|
Reported by Art Mason (1:229/15).
|
|
|
|
RA111TO2 Claims to upgrade RemoteAccess 1.11 to 2.0 - acts similarly to
|
|
the OPTIBBS file reported above. Reported by Peter Janssens
|
|
(2:512/1).
|
|
|
|
RAFIX "Fixes little bugs" in RemoteAccess - program contains the
|
|
string "COMMAND /C FORMAT C:" internally. Reported by Sylvain
|
|
Simard (1:242/158).
|
|
|
|
RAMANAGE Claimed USERS.BBS manager for RemoteAccess - yet another
|
|
file that makes an archive of this file (MIX1.ARJ or WISE.ARJ)
|
|
and places it in a download directory. Reported by Peter
|
|
Janssens.
|
|
|
|
NOTE - Peter Hoek (2:281/506.15) reports a program that does
|
|
the same thing, but uses the archive name RUNNING.ARJ to
|
|
hold the USERS.BBS file. No name of the Trojan was supplied.
|
|
|
|
REAPER ANSI bomb - remaps the keyboard to force file deletion and
|
|
hard disk formatting - also generates insults. Reported by
|
|
Victor Padron (1:3609/14), via Rich Veraa (1:135/907).
|
|
|
|
REDFOX Batch file which deletes all DOS and system files. Reported
|
|
by Mike Wenthold.
|
|
|
|
ROLEX Possible isolated incident of an infection by the Keypress
|
|
[Key] virus. Reported by David Gibbs, via Michael Toth
|
|
(1:115/220).
|
|
|
|
SBBSFIX Tries to format drive C: - contains two files, SBBSFIX.EXE and
|
|
COM_P.OVL. Reported by Clayton Mattatall (1:247/400).
|
|
|
|
SPEED Claims to "check your PC speed" - actually deletes all files
|
|
on drive C:, including directories. Reported by HW Nemrod
|
|
Kedem.
|
|
|
|
XYPHR2 No claim - contains the Power Pump companion virus (documented
|
|
in the 1992 Full Archive of this report). Reported by Mark
|
|
Histed (1:268/332).
|
|
|
|
|
|
YPCBR101 A copy of this file, uploaded to Simtel-20 and the oak mirror
|
|
on archie.au, contained an infection of the Dark Avenger
|
|
virus in the file YAPCBR.EXE. Was supposed to be re-released
|
|
as a clean archive. Reported by John Miezitis (Internet,
|
|
John.Miezitis@cc.utas.edu.au).
|
|
|
|
=========================================================================
|
|
|
|
Pirated Commercial Software
|
|
|
|
Program Archive Name(s) Reported By
|
|
======= =============== ===========
|
|
3-D Pool 3DPOOL Michael Gibbs (via Bill
|
|
Lambdin)
|
|
|
|
| Alone in the Dark ALONEDEM Mark Mistretta (1:102/1314)
|
|
| (full game-not a demo)
|
|
|
|
Atomix (game) ATOMIX_ HW Matt Kracht
|
|
|
|
| A-Train by Maxis ATRAIN1 through Chris Blackwell of Maxis
|
|
| ATRAIN6, also (zoinks@netcom.com)
|
|
| A-TRAIN1 through
|
|
| A-TRAIN6
|
|
|
|
Battle Chess CHESS Ron Mahan (1:123/61)
|
|
|
|
Check-It PC CHECKIT HW Bert Bredewoud
|
|
Diagnostic Software CHKIT20 Bill Lambdin
|
|
|
|
Commander Keen _1KEEN5 Scott Wunsch (1:140/23.1701)
|
|
(part 5)
|
|
|
|
| Copy II PC COPYPC70 Ryan Park (1:283/420)
|
|
|
|
Darkside (game) DARKSIDE Ralph Busch (1:153/9)
|
|
|
|
| DiskDupe Pro v4.03 DD403PRO Jan Koopmans (2:512/163)
|
|
|
|
Energizer Bunny Screen ENERGIZR Kurt Jacobson, PC Dynamics,
|
|
Saver for Windows Inc., via HW Bill Dennison
|
|
|
|
| Family Feud (game) FAM-FEUD Harold Stein (1:107/236)
|
|
|
|
F-Prot Professional FP206SF Mikko Hypponen
|
|
(mikko.hypponen@compart.fi)
|
|
|
|
| Golden Axe (game) GOLDAXE Harold Stein
|
|
|
|
| Ian Bothams Cricket IBCTDT Vince Sorensen (1:140/121)
|
|
|
|
Killing Cloud (game) CLOUD Mike Wenthold
|
|
|
|
| Life & Death (game) L&D1 Harold Stein
|
|
| L&D2
|
|
|
|
MegaMan (game) MEGAMAN Emanuel Levy (1:266/63)
|
|
|
|
| Oh No, More Lemmings ONMLEMM Larry Dingethal (1:273/231)
|
|
| (complete-not demo)
|
|
|
|
Over the Net OTNINC1 Tim Sitzler (1:206/2708)
|
|
(volleyball game)
|
|
|
|
PKZip v2.04c PK204REG HW Scott Raymond
|
|
(Registered)
|
|
|
|
PKZip v2.04c PKZCFG Mark Mistretta (1:102/1314)
|
|
Configuration Editor
|
|
|
|
PKZip v2.04e PK204ERG HW Scott Raymond
|
|
(Registered)
|
|
|
|
| PKZip v2.04g PKZ204R HW Bill Dennison
|
|
| (Registered)
|
|
|
|
PrintShop PSHOP Michael Gibbs, Intelec, via
|
|
Bill Lambdin
|
|
|
|
Psion Chess 3D-CHESS Matt Farrenkopf (1:105/376)
|
|
|
|
QModem v6.0 QM60IST1 Francois Thunus (2:270/25)
|
|
QM60IST2
|
|
|
|
QModem Pro QMPRO-1 Mark Mistretta
|
|
QMPRO-2
|
|
|
|
Rack 'Em (game) RACKEM Ruth Lee (1:106/5352)
|
|
|
|
| Sequencer Plus Pro SPPRO Tom Dunavold (Intelec,
|
|
| via Larry Dingethal)
|
|
|
|
Shadow Warriors (game) SHADOWG Mark Mistretta
|
|
|
|
Sharky's 3D Pool POOL Jason Robertson (1:250/801)
|
|
|
|
| Shez (Registered) SHEZ84R Eric Vanebrick (2:291/712)
|
|
SHEZ85R HW Scott Raymond
|
|
|
|
| SideKick 2.0 SK3 Harold Stein
|
|
|
|
SimCity (by Maxis) SIMCTYSW Scott Wunsch
|
|
|
|
| Star Control Vol. 4 STARCON Carson M. Hanrahan
|
|
| (CompuServe 71554,2652)
|
|
|
|
Streets on a Disk STREETS Harvey Woien (1:102/752)
|
|
|
|
Teledisk (files TDISK214 Mark Mistretta
|
|
dated after Apr. 1991)
|
|
|
|
Vegas Casino 2 (game) VEGAS2 The Hack Squad
|
|
|
|
WinWay Resume for WINRES Erez Carmel (CompuServe,
|
|
Windows 70523,2574)
|
|
|
|
| World Class Rugby WCRFNTDT Vince Sorensen
|
|
|
|
=========================================================================
|
|
|
|
?????Questionable Programs?????
|
|
|
|
First, a quick note - this section, along with the Information, Please
|
|
section, are the only ones that have any information carried over from
|
|
the 1992 report. This is because many of the listings in these sections
|
|
were not completely resolved when the last 1992 issue was published. As
|
|
usual, if anyone has any additional information on anything listed in
|
|
these sections, _please_ help!
|
|
|
|
|
|
| HW Bill Dennison captured a message from Marshall Dudley (Data World BBS,
|
|
| (615)966-3574) in the ILink VIRUS FILE conference about the archive
|
|
| ASCDEMO. Marshall says that McAfee's ViruScan doesn't detect any
|
|
| infection until after you run it and it has infected other files. No
|
|
| further information was supplied, other than the internal filenames
|
|
| (ASCDEMO.DOC and ASCDEMO.EXE). I need further data on this before I can
|
|
| list it in the Trojan Wars section, so please advise if you have any.
|
|
|
|
|
|
| Emanuel Levy (1:266/63) says the file IM, reported by Michael Santos in
|
|
| the Intelec Net Chat conference and listed in the 1992 Full Archive
|
|
| edition of The Hack Report. Michael's report was a "hearsay" report from
|
|
| one of his friends, and stated that the IM screen saver file caused a
|
|
| viral infection.
|
|
|
|
|
| Emanuel says the file is an "outer space screen saver," currently under
|
|
| the filename IM17. Scott Wunsch (1:140/23.1701) says the program name is
|
|
| "Inner Mission," and he currently has version 1.6. In both cases, the
|
|
| files were clean.
|
|
|
|
|
| So, it looks like either Michael's friend's system became infected from a
|
|
| different source than the IM file, or that an isolated incident of an
|
|
| infected IM is involved. No way to tell at this writing.
|
|
|
|
|
|
Long time readers of this report will remember a question concerning the
|
|
status of a screen saver called TUNNEL. Ove Lorentzon (2:203/403.6) and
|
|
Bill Roark (RIME address BOREALIS, Shareware conference, via HW Richard
|
|
Steiner) both stated that the program was an internal IBM test program
|
|
and was not intended for outside distribution.
|
|
|
|
Your Hack Squad has received word from the author of the program, Dan
|
|
Butterfield (Internet, danielb@vnet.ibm.com), that as far as he is aware,
|
|
the program has never been released to the general public. According to
|
|
Dan, "it is still owned by IBM, and as such has been given the IBM
|
|
security classification 'IBM Internal Use Only' which means what it says:
|
|
the program is not for distribution to non-IBM employees."
|
|
|
|
Dan also says that several other "Internal Use Only" programs have been
|
|
"leaked" to the outside world, which implies that these files should not
|
|
be posted for download. One such program was originally called Dazzle
|
|
(NOT to be confused with the other popular DAZZLE screensaver), but has
|
|
entered BBS distribution under the filename O-MY-GOD. Another is a
|
|
program that is usually included inside other archives: the program name
|
|
is PLAYANI. Dan says this has been distributed "along with various
|
|
animations," and also falls under the same Internal classification.
|
|
|
|
A prime example of this is an archive called BALLS (not what you think).
|
|
This is an animation of multiple chrome spheres rotating around each
|
|
other above a red and white checkerboard platform. In this case, both
|
|
the player (PLAYANI) _and_ the animation are the property of IBM and are
|
|
not intended for BBS distribution.
|
|
|
|
Again, to quote Dan, "None of these programs are for external
|
|
distribution; all are owned by IBM and are only for use inside IBM by IBM
|
|
employees." Thanks to Dan for all of his help.
|
|
|
|
|
|
Donn Bly has cleared up the question on the status of the Sydex program
|
|
TeleDisk, first raised by Mark Draconis (1:120/324) and Kelvin Lawson.
|
|
Donn was kind enough to mail a copy of a letter sent to him by Sydex
|
|
explaining that Teledisk is no longer shareware. Here is an excerpt from
|
|
the letter:
|
|
|
|
"Effective April 1991, TeleDisk is no longer a shareware
|
|
product. After long consideration, we decided to
|
|
discontinue our offering of the shareware edition of
|
|
TeleDisk, and license it only as a commercial product.
|
|
|
|
"Commercial licenses of TeleDisk are available from Sydex at
|
|
$150 a copy. All shareware distributors and BBS sysops who
|
|
take time to check their sources are requested to remove
|
|
TeleDisk from shareware distribution."
|
|
|
|
The letter is signed by Miriam St. Clair for Sydex. To summarize, Sydex
|
|
is no longer accepting shareware registrations for TeleDisk, and asks
|
|
that it be not be made available for download from BBS systems.
|
|
|
|
Thanks to Donn for his help in this matter.
|
|
|
|
|
|
HW Ken Whiton forwards messages from Harold Stein, Gary Rambo, and Gwen
|
|
Barnes of Mustang Software, Inc., about a "patch" program aimed at
|
|
OffLine Xpress (OLX) v1.0. The patch is supposed to allow OLX to
|
|
read and reply to Blue Wave packets, along with a lot of other seemingly
|
|
unbelievable feats. Gwen Barnes did not seem to know of the patch, but
|
|
published the following advice in the WildNet SLMROLX conference to
|
|
anyone considering trying it:
|
|
|
|
1. Make a complete backup of your system.
|
|
2. Make sure you've got all the latest SCAN stuff from McAfee
|
|
3. Try it, keeping in mind that it more than likely does nothing
|
|
at all, or is a trojan that will hose your system.
|
|
4. Get ready to re-format and restore from backups if this is in
|
|
fact the case.
|
|
|
|
No filename was given for this patch. If anyone runs across a copy of
|
|
it, please contact one of The HackWatchers or myself so that we can
|
|
forward a copy to MSI for testing.
|
|
|
|
|
|
Bill Lambdin (1:343/45) reports that someone has taken all of McAfee
|
|
Associates' antiviral programs and combined them into one gigantic (over
|
|
700k) archive. He did not say whether the files had been tampered with,
|
|
but he did send a copy to McAfee for them to dissect. The file was
|
|
posted under the filename MCAFEE99. I would not suggest downloading this
|
|
file: as a matter of fact, this reporter prefers to call McAfee's BBS
|
|
directly when a new version of any of their utilities comes out. I
|
|
highly recommend this method, since it insures that you will receive an
|
|
official copy.
|
|
|
|
|
|
HW Matt Kracht forwarded a message from Stu Turk in the DR_DEBUG
|
|
echo about possible Trojans going around as PKZIP 2.21 and/or 2.22. Stu
|
|
also says that there is a warning about these in circulation. If you
|
|
have a copy of this warning, please send a copy to Hack Central Station
|
|
(1:382/95).
|
|
|
|
=========================================================================
|
|
|
|
Information, Please
|
|
|
|
This the section of The Hack Report, where your Hack Squad asks for
|
|
_your_ help. Several reports come in every week, and there aren't enough
|
|
hours in the day (or fingers for the keyboards) to verify them all. Only
|
|
with help from all of you can The Hack Report stay on top of all of the
|
|
weirdness going on out there in BBSLand. So, if you have any leads on
|
|
any of the files shown below, please send it in: operators are standing
|
|
by.
|
|
|
|
|
|
| Onno Tesink (2:283/318) has sighted a file called LHA255B. This claims
|
|
| to be version 2.55b of the LHA archiver, with a file date in the
|
|
| executable of 12/08/92. He compared the file to the latest known
|
|
| official release, v2.13, and found two additional program options which
|
|
| were mentioned when the program was invoked with no command line
|
|
| (generating a help screen). The archive contained nothing but the
|
|
| executable file. Viral scans were negative.
|
|
|
|
|
| Many, MANY other folks have seen this file, as well as one called LHA252.
|
|
| Your Hack Squad has copies of both files. The LHA252 file contains
|
|
| Japanese documentation, so it is a bit of a tough nut to crack.
|
|
|
|
|
| I have not heard of any further development going on by the author of
|
|
| LHA, H. Yoshi, but that wouldn't be a first. <g> He is supposedly
|
|
| contactable via the NIFTY-SERVE service of CompuServe. However, this
|
|
| service requires some knowledge of Japanese, and my only foreign language
|
|
| training was a semester of Czech at the University of Texas.
|
|
|
|
|
| If anyone knows of a new version of LHA, or has CompuServe access and the
|
|
| ability to converse in Japanese (and would be willing to assist), please
|
|
| contact your nearest HackWatcher or me and lend a hand. This is getting
|
|
| very frustrating. <grin>
|
|
|
|
|
|
Travis Griggs (1:3807/4.25) forwarded a report from a local board called
|
|
The Forum (phone number 1-318-528-2107) by a user named Susan Pilgreen.
|
|
The message referred to a file called BOUNCE, which she said was infected
|
|
with the Russian Mirror virus. The file, according to Travis, claimed to
|
|
be a game. I would appreciate further confirmation of this sighting.
|
|
|
|
|
|
| An update on a warning from Mark Stansfield (1:115/404), concerning
|
|
| the files KILL and PROTECT. He claims that these delete the user's hard
|
|
| drive when run. Dan Onstott (1:100/470) reported in the FidoNet SHAREWRE
|
|
| echo that he has a small utility called PROTECT.COM (205 bytes, dated
|
|
| 12-10-86), which is a write-protect utility for your hard drive. He says
|
|
| he has never had a problem with it.
|
|
|
|
|
| Jerry Han (jhan@debra.dgbt.doc.ca) has a copy of a program called KILL.
|
|
| This file is a utility that removes entire branches of a directory tree,
|
|
| and is safe when used correctly. The program was written by two of his
|
|
| friends and distributed as shareware: current version is 1.5.
|
|
|
|
|
| So, Mark's report may be an isolated incident. If anyone else sees the
|
|
| files Mark mentioned, please advise.
|
|
|
|
|
|
Bill Lambdin forwards a message from Mario Giordani in the ILink Virus
|
|
Conference about two files. The archives, called PHOTON and NUKE, are
|
|
possibly droppers, containing a file called NUKE.COM which "will trash
|
|
your HD."
|
|
|
|
Pat Finnerty (1:3627/107) sent a reply to the last report of this,
|
|
stating that he has a copy of a PC Magazine utility called NUKE.COM,
|
|
which is used to remove subdirectories which contain "nested subs,
|
|
hidden, read-only (you name it)." He says that the command NUKE C:\ will
|
|
effectively delete everything on a hard drive, with no chance of repair.
|
|
This is merely the way the program is designed.
|
|
|
|
I do not know if this is what happened in Mario's case, or if Mario
|
|
actually found a copy (read: isolated incident) which was infected. Bill
|
|
has asked Mario for further information, and I would like to echo his
|
|
call for help. If you know of this, please lend a hand.
|
|
|
|
|
|
Another one forwarded by Bill comes from Michael Santos in the Intelec
|
|
Net Chat conference, concerning a screen saver named IM. This is only a
|
|
"hearsay" report from one of Michael's friends, who says he downloaded it
|
|
and wound up with a virus. There is no way to tell if the infection came
|
|
from the file itself or if it was already present on his friend's system.
|
|
Once again, if anyone can clear this up, please do so.
|
|
|
|
|
|
Ned Allison (1:203/1102) forwarded a report into the FidoNet DIRTY_DOZEN
|
|
echo from a user of The Mailbox BBS in Cleveland (216/671-7534) named
|
|
Rich Bongiovanni. Rich reports that there is a file floating around
|
|
called DEMON WARS (archive name DMNWAR52) that is "infected with a
|
|
virus." If true, this may be an isolated incident. I would appreciate
|
|
confirmation on this.
|
|
|
|
|
|
Greg Walters (1:270/612) reports a possible isolated incident of a
|
|
problem with #1KEEN7. When he ran the installation, he began seeing on
|
|
his monitor "what looked like an X-rated GIF." The file apparently
|
|
scanned clean. Any information on similar sightings would be
|
|
appreciated.
|
|
|
|
|
|
A report from Todd Clayton (1:259/210) concerns a program called
|
|
ROBO.EXE, which he says claims to apparently "make RoboBoard run 300%
|
|
faster." He says he has heard that the program fools around with your
|
|
File Allocation Table. I have not heard any other reports of this, so I
|
|
would appreciate some confirmation from someone else who has seen similar
|
|
reports.
|
|
|
|
|
|
Kelvin Lawson (2:258/71) posted a message in the SHAREWRE echo about a
|
|
possible hack of FEBBS called F192HACK. I have not seen this file, nor
|
|
has the author of FEBBS, Patrik Sjoberg (2:205/208). He forwards the
|
|
file sizes in the archive, reported here:
|
|
|
|
Name Length Mod Date Time CRC
|
|
============ ======== ========= ======== ========
|
|
FEBBS.EXE 220841 09 Mar 92 21:17:00 96D2E08D
|
|
014734.TXT 1403 26 Aug 92 01:59:18 3B9F717F
|
|
============ ======== ========= ======== ========
|
|
*total 2 222244 26 Aug 92 01:59:24
|
|
|
|
Kelvin says the .TXT file is just an advert for a BBS, so it is "not
|
|
relevant!". As I said, the author of FEBBS has never seen this file, so
|
|
I've asked Kelvin to forward a copy of it to him.
|
|
|
|
|
|
Andrew Owens (3:690/333.11) forwarded a report of a "Maximus BBS
|
|
Optimiser (sic)," going under the filenames MAX-XD and MAXXD20. Scott
|
|
Dudley, the author of Maximus, says he did not write any programs that
|
|
have these names, but he does not know whether they are or are not
|
|
legitimate third party utilities. I have requested further information
|
|
from Andrew on this topic, and would appreciate anyone else's
|
|
information, if they have any.
|
|
|
|
|
|
Yet another short warning comes from David Bell (1:280/315), posted in
|
|
the FidoNet SHAREWRE echo, about a file called PCPLSTD2. All he says is
|
|
that it is a Trojan, and that he got his information from another
|
|
"billboard" and is merely passing it on. Again, please help if you know
|
|
what is going on here.
|
|
|
|
|
|
Bud Webster (1:264/165.7) reports an Apogee game being distributed under
|
|
the filename BLOCK5.ZIP. He says that the game displayed a message that
|
|
said, "This game is not in the public domain or shareware." There was
|
|
only an .EXE file in the archive, and no documentation. I need to know
|
|
what the real name of this game is so that I can include it in the
|
|
pirated files section (if necessary).
|
|
|
|
|
|
A message in the FidoNet ASIAN_LINK echo from Choon Hwee (1:3603/263)
|
|
grabbed my attention the moment I saw it: in capital letters, it said,
|
|
"DO NOT RUN this file called MODTEXT.EXE, cause it is a TROJAN!!!". He
|
|
goes on to say that two BBSs have been destroyed by the file. However,
|
|
that's about all that was reported. I really need more to go on before I
|
|
can classify this as a Trojan and not just a false alarm (i.e., archive
|
|
name, what it does, etc.). Please advise.
|
|
|
|
|
|
Greg Mills (1:16/390) posted a question to Robert Jung in the ARJ Support
|
|
Echo (FidoNet) about a version of ARJ called 2.33. It was unclear as to
|
|
whether or not Mr. Mills had seen the file. Mr. Jung has repeated that
|
|
the latest version of ARJ is v2.30 (however, there is a legitimate public
|
|
beta version numbered 2.39b). It is possible that the references Greg
|
|
saw about 2.33 were typos, but you never know. Please help your Hack
|
|
Squad out on this one - if you see it, report it.
|
|
|
|
=========================================================================
|
|
|
|
The Meier/Morlan List
|
|
|
|
Here are this month's updates on the status of the files contained in the
|
|
Meier/Morlan List.
|
|
|
|
|
|
| Lee Madajczyk (1:280/5) surmises that HARRIER could be Harrier Combat
|
|
| Simulator by Mindscape, Inc. He says that he hasn't seen anything from
|
|
| them in quite a while, and doesn't know if the company is still in
|
|
| business.
|
|
|
|
|
|
| Jeffrey Marshall (1:153/733) forwarded information confirming that
|
|
| STARGOOSE, listed in the list as SPACEGOO, is copyrighted freeware and
|
|
| can be distributed via BBSs. If someone has merely renamed the archive,
|
|
| then I might consider the SPACEGOO file a hoax. However, I have no
|
|
| information to support this. Therefore, SPACEGOO comes out of the list,
|
|
| unless someone has specific information on it. Thanks to Jeffrey for his
|
|
| help.
|
|
|
|
|
|
| HW Nemrod Kedem says that FIXDOS50 is an official patch for IBM DOS v5.0,
|
|
| according to his contact with IBM officials. IBM has had a policy of
|
|
| releasing some patches via BBS systems, so FIXDOS50 comes off the list.
|
|
|
|
|
|
| Emanuel Levy (1:266/63) has some more input to add to last month's
|
|
| information:
|
|
|
|
|
| AFOX - possibly Artic Fox by Electronic Arts
|
|
| WINGIF - possible registered version of a shareware Windows .GIF viewer
|
|
| 387DX - sounds like a Math Co-Processor emulator - might be legit
|
|
|
|
|
| Confirmation of these would be appreciated. In the meantime, here are
|
|
| the remaining unresolved reports from Emanuel:
|
|
|
|
"Barkeep sounds like it may be a version of Tapper. If you send beer mugs
|
|
down the screen to patrons and then have to pick up the returning mugs
|
|
and they leave tips, then it is Tapper. Or it may be an OLD game
|
|
published in Compute Mag. If it is the one from Compute only those who
|
|
have the Compute issue with the game in it are allowed to have a copy.
|
|
|
|
"Harrier is either Harrier Jiump Jet or Space Harrier from Sega wich came
|
|
out for the Commodore 64 in 89 so I would assume it came out for IBM
|
|
around then too.
|
|
|
|
"Gremlins- There was an Gremlins Text Adventure and a Video Came for the
|
|
computer. The video game was put out by Atari
|
|
|
|
"Antix may be Artic Antix one lof the Spy vs Spy games
|
|
|
|
| Thanks, Emanuel. While we're on the subject of ANTIX, here is some
|
|
| further information on this file:
|
|
|
|
|
| Andrew McCullough (1:2614/409) has a copy of a game called ANTIX,
|
|
| mentioned above. According to Andrew, "as far as I can tell it is
|
|
| legit." He says it is a "'dinky' little program where you try to eat
|
|
| away 75% of the screen without being hit by the 'bad guys'."
|
|
|
|
|
| Steve Huston (1:266/49) and Matthew Evanson (mevanson@iastate.edu)
|
|
| confirm Andrew's report. Matthew says that it used to be a top download
|
|
| on America OnLine, and that it is a legitimate shareware game. So, with
|
|
| this, ANTIX comes off the list.
|
|
|
|
|
|
For those who have missed it before, here is what is left of the list of
|
|
files forwarded by Joe Morlan (1:125/28), as compiled by Wes Meier, SysOp
|
|
of the WCBBS (1-510-937-0156) and author of the AUNTIE BBS system. Joe
|
|
says Wes keeps a bulletin of all rejected files uploaded to him and the
|
|
reasons they were rejected. Joe also says he cannot confirm or deny the
|
|
status of any of the files on the list.
|
|
|
|
There are some that I am not familiar with or cannot confirm. These are
|
|
listed below, along with the description from Wes Meier's list.
|
|
|
|
Due to the unconfirmed nature of the files below, the filenames are not
|
|
included in the columnar lists. I would appreciate any help that
|
|
anyone can offer in verifying the status of these files. Until I receive
|
|
some verification on them, I will not count them as either hacks or
|
|
pirated files. Remember - innocent until proven guilty.
|
|
|
|
My thanks go to Joe and Wes for their help.
|
|
|
|
Filename Reason for Rejection
|
|
======== =============================================
|
|
BARKEEP Too old, no docs and copyrighted with no copy
|
|
permission.
|
|
HARRIER Copyrighted. No permission to copy granted.
|
|
SLORGAME Copyrighted. No docs. No permission to copy
|
|
granted.
|
|
NOVELL Copyrighted material with no permission to
|
|
BBS distribute
|
|
DRUMS I have no idea if these are legit or not. No
|
|
docs.
|
|
GREMLINS No documantation or permission to copy given.
|
|
NAVM Copyrighted. No permission to copy granted.
|
|
TESTCOM Copyrighted. No permission to copy granted.
|
|
CLOUDKM A hacked commercial program.
|
|
MENACE Copyrighted. No docs. No permission to copy
|
|
granted.
|
|
AIRBALL A hacked commercial program.
|
|
SNOOPY Copyrighted. No docs. No permission to
|
|
copy granted.
|
|
SLORDAX Copyrighted. No docs. No permission to
|
|
copy granted.
|
|
ESCAPE Copyrighted. No docs. No permission to
|
|
copy granted.
|
|
AFOX A cracked commercial program.
|
|
BANNER Copyrighted. No docs. No permission to
|
|
copy granted.
|
|
WINGIF14 The author's documentation specifically
|
|
requests this file to not be distributed.
|
|
INTELCOM Copyrighted. No docs. No permission to
|
|
copy granted.
|
|
387DX Copyrighted. No docs or permission to
|
|
copy granted.
|
|
WINDRV Copyrighted. No permission to copy granted.
|
|
|
|
=========================================================================
|
|
|
|
Help!!!
|
|
|
|
Would the person who sent the copy of Vegas Casino 2 (filename VEGAS2) to
|
|
The Hack Squad for testing/verification please re-identify themselves via
|
|
NetMail? Somehow, your message went to the great Bit Bucket in the sky.
|
|
Thanks in advance!
|
|
|
|
*************************************************************************
|
|
|
|
Conclusion
|
|
|
|
If you see one of these on a board near you, it would be a very friendly
|
|
gesture to let the SysOp know. Remember, they can get in just as much
|
|
trouble as the fiend who uploads pirated files, so help them out if you
|
|
can.
|
|
|
|
***HACK SQUAD POLICY***
|
|
|
|
The intent of this report is to help SysOps and Users to identify
|
|
fraudulent files. To this extent, I give credit to the reporter of a
|
|
confirmed hack. On this same note, I do _not_ intend to "go after" any
|
|
BBS SysOps who have these programs posted for d/l. The Shareware World
|
|
operates best when everyone works together, so it would be
|
|
counter-productive to "rat" on anyone who has such a file on their board.
|
|
Like I said, my intent is to help, not harm. SysOps are strongly
|
|
encouraged to read this report and remove all files listed within from
|
|
their boards. I can not and will not take any "enforcement action" on
|
|
this, but you never know who else may be calling your board. Pirated
|
|
commercial software posted for d/l can get you into _deeply_ serious
|
|
trouble with certain authorities.
|
|
|
|
Updates of programs listed in this report need verification. It is
|
|
unfortunate that anyone who downloads a file must be paranoid about its
|
|
legitimacy. Call me a crusader, but I'd really like to see the day that
|
|
this is no longer true. Until then, if you _know_ of a new official
|
|
version of a program listed here, please help me verify it.
|
|
|
|
On the same token, hacks need to be verified, too. I won't be held
|
|
responsible for falsely accusing the real thing of being a fraud. So,
|
|
innocent until proven guilty, but unofficial until verified.
|
|
|
|
Upcoming official releases will not be included or announced in this
|
|
report. It is this Co-Moderator's personal opinion that the hype
|
|
surrounding a pending release leads to hacks and Trojans, which is
|
|
exactly the opposite of what I'm trying to accomplish here.
|
|
|
|
If you know of any other programs that are hacks, bogus, jokes, hoaxes,
|
|
etc., please let me know. Thanks for helping to keep shareware clean!
|
|
|
|
Lee Jackson, Co-Moderator, FidoNet International Echo SHAREWRE, and
|
|
Moderator, FidoNet Echo WARNINGS (1:382/95)
|