714 lines
39 KiB
Plaintext
714 lines
39 KiB
Plaintext
==========================
|
|
bbs/long.messages #13, from billbourn, 39479 chars, Sat Sep 27 17:41:38 1986
|
|
--------------------------
|
|
TITLE: Another edition of the Dirty Dozen (40K ! and some commercial aspects)
|
|
|
|
|
|
----------------------------------------------------------------------------
|
|
| |
|
|
| THE DIRTY DOZEN -- An Uploaded Program Alert List |
|
|
| |
|
|
----------------------------------------------------------------------------
|
|
| Issue #6: September 5th, 1986 |
|
|
| |
|
|
| |
|
|
| |
|
|
| Compiled by Eric Newhouse |
|
|
----------------------------------------------------------------------------
|
|
|
|
|
|
Recently, many unlawfully copied or modified programs have appeared on
|
|
various IBM PC bulletin boards across the country. THE DIRTY DOZEN is a
|
|
list of known examples.
|
|
|
|
There are four major categories of "bogusware": commercial pirate jobs,
|
|
unauthorized "hacks" of otherwise legitimate freeware programs, malicious
|
|
"TROJAN" programs which damage your system, and miscellaneous illegal
|
|
software. A more detailed explanation of each category is given in the
|
|
definitions section of this document.
|
|
|
|
SysOps: Please be careful with the files you post in your download
|
|
libraries! Be suspicious when an uploaded game or disk utility appears to
|
|
be of professional quality, yet doesn't include the author's name, address,
|
|
nd distribution policy. Such programs are probably NOT public domain!
|
|
|
|
The BBS community is already under legislative threat at the State and
|
|
Federal level. We cannot fight this trend effectively while our directories
|
|
sit stocked with "cracked" Sega games, 1-2-3 copiers and Wargames dialers!
|
|
Let's demonstrate a little social responsibility by cleaning up our download
|
|
libraries. If you as a SysOp have any of these files on your system, please
|
|
delete them and post "blocking" dummy file entries like this one:
|
|
|
|
ZAXXON.COM DELETED!! NOT PUBLIC DOMAIN!!
|
|
|
|
The idea behind THE DIRTY DOZEN is simultaneously to bring this issue to
|
|
the attention of more SysOps and users, and to act as an information clearing-
|
|
house for the latest known examples of "bogusware." I need YOUR help! Please
|
|
call in any updates of bad software that you know of; see the end of this
|
|
article for information on how to reach me with new information.
|
|
|
|
A word on TROJANS: I have been hearing more and more reports of these
|
|
"worm" programs, from all directions. While I don't doubt their existence,
|
|
let's not get hysterical. Remember, a Trojan rumor is a lot easier to START
|
|
than it is to STOP. Some people have accused "legitimate" *joke* programs,
|
|
like DRAIN (which pretends to be gurgling excess water out of your A drive) of
|
|
being "killers." If a program locks up your system, it isn't necessarily
|
|
Trojan; it might not like co-residing with Superkey, or your graphics card.
|
|
Ask around a little before you announce something as Trojan. I would
|
|
appreciate a bagged specimen of any real Trojan program that you might have
|
|
the (un)luck to find.
|
|
|
|
A word on Pirated programs: Recently many pirated programs such as AUTODEX
|
|
have been going under many different names. Although I will try to keep
|
|
all these names current in the DD, the best way to check and see if a
|
|
file is pirated is to run it yourself -- checking for (C)opyright
|
|
notices of commercial manufactures, similarities in looks and operations
|
|
of commercial programs, and of course whether the name is in this list.
|
|
|
|
Starting with version 5.0 of the Dirty Dozen, "bad" files are
|
|
separated into two sections: one for those files that are pirated, and
|
|
one for those that are hacked or trojan. This is because most of the
|
|
"bad" files these days are PIRATED, and in my view pirated files are
|
|
less important than TROJAN HORSES. Therefore, the "Trojans" and
|
|
"Hacked" programs are listed first in this document. More information
|
|
on "Trojan," "Hacked," and "Pirated" may be found at the "definitions"
|
|
part of this document.
|
|
|
|
About two days before the release of this list, a user of mine notified
|
|
that a pirate had patched HARDHAT.COM to read "cracked by Eric Newhouse."
|
|
|
|
This is ridiculous! Please disregard any programs that you may come across
|
|
in the future advertising "copy protection busted by Eric Newhouse, " or
|
|
the like. This is just one more way that pirates are trying to get me
|
|
to stop publishing this list!
|
|
|
|
Finally I want to thank all bbs SysOps and users that notified me of
|
|
updates, additions, and/or corrections to DIRTYDOZ.005. It's great to
|
|
see so much support! In this issue more than ever people called in with
|
|
updates. As I said, thanks a lot! Everyone else who reads this
|
|
list, along with myself, really appreciates your effort!
|
|
|
|
Final Note: The author takes no responsibility for the validity or
|
|
completeness of this list. Many sources contribute to
|
|
the list, and it is very possible that one of the reported
|
|
"dirty" files works perfectly and is in the Public Domain.
|
|
On the same token, it is impossible to write all existing bad
|
|
software into one list. Everyday users upload bad software
|
|
to hundreds of boards, and often times the software is not yet
|
|
in this list. What I am saying, basically, is that if you run
|
|
a trojan horse that is not listed in this list, don't call my
|
|
board up blaming me for not warning you about the trojan;
|
|
rather, please call up and leave me a message so that I can get
|
|
the destructive program in the next issue. If anyone is unsure
|
|
whether a file is trojan, and it's not listed in here, then I
|
|
recommend using a utility like BOMBSQAD.COM to prevent any
|
|
mishaps.
|
|
|
|
|
|
DEFINITIONS:
|
|
|
|
|
|
HACKED An unlawfully modified copy of an otherwise legitimate
|
|
freeware or user-supported program. It is illegal to
|
|
distribute a modified copy of someone else's work without
|
|
their permission. If the modifying party has obtained
|
|
that permission, it should be mentioned in the program's
|
|
display or documentation.
|
|
|
|
*TROJAN* BEWARE!! The purposes of these programs are to intentionally
|
|
damage the computer system that they are run on. Usually they
|
|
will aim to disable hard disks, although they can destroy other
|
|
equipment too. It is IMPERATIVE that you let me know about any
|
|
new examples of these that you find.
|
|
|
|
PIRATED This is an illegal copy of a commercial program product.
|
|
Examples: a "cracked" (de-protected) game, an accidentally
|
|
or deliberately distributed compiler, editor or utility;
|
|
sometimes a Beta test copy of a program under development,
|
|
handed out by a disgruntled employee or dishonest beta
|
|
tester. In the latter case, the program in question may
|
|
never make it to market due to the pirating! (But it's
|
|
still unlawful to distribute it.) In the case of games,
|
|
there's a tendency for the pirate to patch a clumsy
|
|
"PUBLIC DOMAIN" notice over top of the original copyright.
|
|
ZAXXON.COM is a prime example.
|
|
|
|
|
|
MISC This is miscellaneous illegal software and/or text.
|
|
The best definition, aside from that, that I can think of
|
|
is that it's NOT pirated software.
|
|
|
|
|
|
NOTE: If no file extension is supplied, that means that the file has been
|
|
circulating under many different extensions. For instance, BALKTALK has
|
|
been seen with extensions of: .EXE, .COM, .EQE, .CQM, .LBR, .LQR, and .ARC.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
----------------------------------------------------------------------------
|
|
| HACKED & TOJAN HORSE PROGRAMS: |
|
|
----------------------------------------------------------------------------
|
|
|
|
|
|
Name Category Notes
|
|
-------------- -------- -------------------------------------------------
|
|
ARC.COM HACKED Someone keeps running SPACEMAKER or a similar EXE
|
|
squeezer on SEA, Inc.'s ARC archive program, then
|
|
uploading the resulting COM file to BBS's without
|
|
the author's permission. Not kosher, whoever you
|
|
are. SEA will NOT support the COM version -- this
|
|
is an unauthorized modification.
|
|
ARC513.EXE *TROJAN* This hacked version of arc appears normal, so
|
|
beware! It will write over track 0 of your
|
|
[hard] disk upon usage, destroying the disk.
|
|
ARC514.COM *TROJAN* This is totally similar to arc version 5.13 in that
|
|
it will overwrite track 0 (FAT Table) of your hard
|
|
disk. Also, I have yet to see an .EXE version
|
|
of this program..
|
|
ARC600.EXE *TROJAN* This supposedly formats all hard disks on the
|
|
system that the program is run on.
|
|
BALKTALK *TROJAN* This program used to be a good PD utility,
|
|
but some one changed it to be trojan.
|
|
Now this program will write/destroy sectors
|
|
on your [hard] disk drive. Use this with caution
|
|
if you acquire it, because it's more than likely
|
|
that you got a bad copy.
|
|
CDIR.COM *TROJAN* This program is supposed to give you a color
|
|
directory of files on disk, but it in fact
|
|
will scramble your disks FAT table.
|
|
DISKSCAN.EXE *TROJAN* This was a PC-MAGAZINE program to scan a hard disk
|
|
for bad sectors, but then a joker edited it to
|
|
WRITE bad sectors. Also look for this under other
|
|
names such as SCANBAD.EXE and BADDISK.EXE...
|
|
DOSKNOWS.EXE *TROJAN* I'm still tracking this one down -- apparently
|
|
someone wrote a FAT killer and renamed it
|
|
DOSKNOWS.EXE, so it would be confused with the
|
|
real, harmless DOSKNOWS system-status utility.
|
|
All I know for sure is that the REAL DOSKNOWS.EXE
|
|
is 5376 bytes long. If you see something called
|
|
DOSKNOWS that isn't close to that size, sound the
|
|
alarm. More info on this one is welcomed -- a
|
|
bagged specimen especially.
|
|
EGABTR *TROJAN* BEWARE! Description says something like
|
|
"improve your EGA display," but when run it
|
|
deletes everything in sight and prints "Arf! Arf!
|
|
Got you!"
|
|
FILER.EXE *TROJAN* One SysOp complained a while ago that this program
|
|
wiped out his 20 Megabyte HD. I'm not so
|
|
sure that he was correct and/or telling the
|
|
truth any more. I have personally tested an
|
|
excellent file manager also named FILER.EXE, and
|
|
it worked perfectly. Also, many other SysOp's
|
|
have written to tell me that they have like me
|
|
used a FILER.EXE with no problems. If somebody
|
|
does not confirm that this program is trojan,
|
|
I will take it out of the next issue..
|
|
FUTURE.BAS *TROJAN* This "program" starts out with a very nice color
|
|
picture (of what I don't know) and then proceeds
|
|
to tell you that you should be using your computer
|
|
for better things than games and graphics.
|
|
After making that point it trashes your A: drive,
|
|
B:, C:, D:, and so on until it has erased all
|
|
drives. It does not go after the FAT alone,
|
|
but it also erases all of your data. As far as I
|
|
know, however, it erases only one sub-directory
|
|
tree level deep, thus hard disk users should only
|
|
be seriously affected if they are in the "root"
|
|
directory. I'm not sure about this on either,
|
|
though.
|
|
LIST60 HACKED Vuern Buerg's LIST 5.1, patched to read 6.0.
|
|
LIST799 HACKED Vuern Buerg's LIST 5.1, patched to read 7.99.
|
|
MAP *TROJAN* This is another trojan written by the infamous
|
|
TSRMAP "Dorn W. Stickle." The program does what it's
|
|
supposed to do: give a map outlining the location
|
|
(in RAM) of all TSR programs, but it also
|
|
erases the boot sector of drive "C:".
|
|
PACKDIR *TROJAN* This utility is supposed to "pack" (sort and
|
|
optimize) the files on a [hard] disk, but
|
|
apparently it scrambles FAT tables.
|
|
QMDM110.ARC HACKED ONLY versions 1.10 and 1.10A! They are
|
|
QMDM110A.ARC copies of 1.09, hacked to read 1.10. There
|
|
have been rumors of a worm in 1.10, but I
|
|
have seen no evidence of it. Other
|
|
versions are OK.
|
|
QUIKRBBS.COM *TROJAN* This Trojan horse advertises that it will
|
|
load RBBS-PC's message file into memory
|
|
2 times faster than normal. What it really
|
|
does is copy RBBS-PC.DEF into an ASCII file
|
|
named HISCORES.DAT...
|
|
SECRET.BAS *TROJAN* BEWARE!! This may be posted with a note saying
|
|
it doesn't seem to work, and would someone please
|
|
try it; when you do, it formats your disks.
|
|
STAR.EXE *TROJAN* Beware RBBS-PC SysOps! This file puts some
|
|
stars on the screen while copying RBBS-PC.DEF
|
|
to another name that can be downloaded later!
|
|
STRIPES.EXE *TROJAN* Similar to STAR.EXE, this one draws an American
|
|
flag (nice touch), while it's busy copying
|
|
your RBBS-PC.DEF to another file (STRIPES.BQS) so
|
|
Bozo can log in later, download STRIPES.BQS, and
|
|
steal all your passwords. Nice, huh!
|
|
VDIR.COM *TROJAN* This is a disk killer that Jerry Pournelle wrote
|
|
about in BYTE Magazine. I have never seen it,
|
|
although a responsible friend of mine has.
|
|
|
|
|
|
|
|
----------------------------------------------------------------------------
|
|
| PIRATED PROGRAMS: |
|
|
| |
|
|
| |
|
|
| TYPES: |
|
|
| Game -- some sort of game, usually of "Arcade" Quality |
|
|
| Util -- a disk, screen, or general utility |
|
|
| Misc -- miscellaneous, printer controllers, sound, etc. |
|
|
----------------------------------------------------------------------------
|
|
|
|
|
|
|
|
Program Name Type Description
|
|
------------ ---- -----------
|
|
|
|
1DIR.COM PIRATED Util -- This is "The ONE Dir," a commercial shell
|
|
sold with a Hard Disk subsystem.
|
|
21C.EXE PIRATED Game -- From the IBM Game Library -- blackjack
|
|
ACUPAINT PIRATED Misc -- PC Paint -- ARC-ed file is 148,221 bytes.
|
|
ALLEYCAT.COM PIRATED Util -- The IBM game "Alley Cat"
|
|
ALTEREGO.ARC PIRATED Game -- Alter Ego game from Activision
|
|
this archive file is huge -- about 450KB
|
|
or so..
|
|
ARTOFWAR PIRATED Game -- Ancient Art of War game.
|
|
AUTODEX PIRATED Util -- AUTODEX, a commercial file manager
|
|
AXX.EXE PIRATED Util -- also AUTODEX
|
|
B1-BOMB PIRATED Game -- Avalon Hill's B1 Bomber
|
|
BATTLE PIRATED Game -- Battle Zone Game
|
|
BBCHESS PIRATED Game -- Blues Box Chess
|
|
BC-QUEST PIRATED Game -- Bc's Quest for Tires
|
|
BIGMAC.ARC PIRATED Util -- Also Superkey
|
|
BRUCELEE PIRATED Game -- Bruce Lee game
|
|
BUCK PIRATED Game -- Buck Rogers on Planet Zoom
|
|
BURGER PIRATED Game -- Burgertime
|
|
BUSHIDO PIRATED Game -- Karate Game
|
|
BUZZBAIT PIRATED Game -- Buzzard Bait
|
|
CENTIPED PIRATED Game -- Be careful with this one-there are at least
|
|
two legitimate PD copies of Centipede in
|
|
circulation. There pirated one is
|
|
supposably PUBLIC DOMAIN BY ATARI.
|
|
Yeah, Right.
|
|
COSMIC PIRATED Game -- Cosmic Crusaders
|
|
COPYRITE PIRATED Util -- Really Quaid Software's COPYWRITE
|
|
COPYWRIT PIRATED Util -- Quaid Software's COPYWRITE again
|
|
COSMIC PIRATED Game -- Cosmic Crusaders game
|
|
CROSFIRE.COM PIRATED Game -- Cross fire game..
|
|
CRUSH-CC.ARC PIRATED Game -- Crush, Crumble & Chomp Game
|
|
DEB88.EXE PIRATED Misc -- DeSmet "C" debugger
|
|
DECATH PIRATED Game -- Microsoft Decathalon
|
|
DEFENDER PIRATED Game -- Defender
|
|
DIGGER.COM PIRATED Game -- Dig Dug
|
|
DIGDUG.COM PIRATED Game -- Dig Dug
|
|
DISKEX PIRATED Util -- Disk Explorer Utility
|
|
DOSHELP.EXE PIRATED Util -- This is really Central Point Software's
|
|
PC-tools. One special note: There is
|
|
usually a poorly written documentation
|
|
accompanying this file. In the
|
|
documentation ERIC HSU asks for a monetary
|
|
contribution to his bbs. Well, It seems
|
|
that this was a poor attempt to damage
|
|
ERIC HSU's reputation-Eric is a legitimate
|
|
SysOp in the Houston area.
|
|
DOSMENU PIRATED Util -- INTECHS DOSMENU - The Menu screen says "PC
|
|
DOS MENU SYSTEM 5.0" Archive size is
|
|
208,240 - The copyright notice is on the
|
|
bottom of the screen.
|
|
DOSSHELL PIRATED Util -- AUTODEX again
|
|
DRL PIRATED Game -- Avalon Hill's "Dnieper River Line."
|
|
DIPLOMCY PIRATED Game -- Avalon Hill's "Computer Diplomacy" - This
|
|
is a WW2 simulation of the eastern front
|
|
EXPLORER.COM PIRATED Util -- Quaid Software's Disk Explorer
|
|
F15 PIRATED Game -- F-15 Strike Eagle
|
|
FILEEASE PIRATED Util -- Dos Utility
|
|
FILEMGR PIRATED Util -- Really FILE MANAGER by Lotus Devel. Corp.
|
|
FILEMAN PIRATED Util -- Also FILE MANAGER. The file is 10 KBytes
|
|
FSDEBUG PIRATED Util -- IBM's Full Screen Debug program..
|
|
GOLF21.ARC PIRATED Game -- Golf's Best version 2.1
|
|
GREMLINS.COM PIRATED Game -- Gremlins game
|
|
HARDHAT.COM PIRATED Game -- Hard Hat Mack
|
|
HOOP.COM PIRATED Game -- One-on-1
|
|
IBM21 PIRATED Game -- 21c
|
|
IPLTIME.COM PIRATED Util -- IBM Internal Use Clock utility
|
|
JBIRD PIRATED Game -- Jbirds -- Q-bert Game
|
|
JOUST PIRATED Game -- Joust. Be careful, there is a 6K version
|
|
KEYWORKS.ARC PIRATED Util -- Keyworks macro program, usu. version 2.0
|
|
KONG PIRATED Game -- Donkey Kong
|
|
MACE+ PIRATED Util -- Paul Mace's MACE+ utilities
|
|
MACROS PIRATED Util -- Again Superkey, or even Prokey
|
|
MEDMAG.COM PIRATED Util -- Quaid Software's Media Magician
|
|
MISSLEC PIRATED Game -- Missle command
|
|
MONTYS.COM PIRATED Game -- Montezuma's Revenge
|
|
MOONBUGS PIRATED Game -- Moon Bugs
|
|
MS PIRATED Util -- IBM internal utility.
|
|
MTS PIRATED Util -- IBM Multi-tasker that's like DoubleDos
|
|
MUSICCON PIRATED Misc -- Music Construction Set
|
|
NFL.ARC PIRATED Game -- Xor's NFL challenge.
|
|
NICE PIRATED Misc -- A printer Controller
|
|
NORTON.COM PIRATED Util -- Peter Norton's Utilities!
|
|
NOVATRON PIRATED Util -- Tron light cycles.
|
|
ONE-ON-1 PIRATED Game -- One-on-1 basketball game.
|
|
PATHMIND PIRATED Util -- Dos Shell
|
|
PCBOSS PIRATED Util -- Another Dos shell
|
|
PC-POOL PIRATED Game -- Really PC-POOL, commercial game
|
|
POOL.ARC PIRATED Game -- Same
|
|
PC-TOOLS PIRATED Util -- Central Point Software's PC-tools
|
|
PINCONST PIRATED Game -- Pinball Construction Set
|
|
POPALARM.COM PIRATED Util -- Part of POP DOS
|
|
POPDOS.ARC PIRATED Util -- Pop up (resident) dos utilities.
|
|
PROKEY PIRATED Util -- Prokey macros program
|
|
PSHIFT PIRATED Util -- really MEMORY SHIFT
|
|
PSRD.ARC PIRATED Util -- IBM utility (redirects PrtSc)
|
|
QDOS PIRATED Util -- Quickdos
|
|
QIX PIRATED Game -- The game.
|
|
RASTER-B PIRATED Game -- Raster Blaster
|
|
ROBOTRON PIRATED Game -- Robotron, hacked to read PUBLIC DOMAIN BY
|
|
ATARI. Don't pirates have any imagination?
|
|
ROGUE.EXE PIRATED Game -- Game very similar to the PD game HACK.EXE
|
|
ROMANTIC PIRATED Game -- Romantic Encounters at the Dome.
|
|
RE.ARC PIRATED Game -- Same
|
|
SEADRAG.ARC PIRATED Game -- Sea Dragon
|
|
SEE PIRATED Misc -- DeSmet editor
|
|
SFX PIRATED Util -- really AUTODEX (again!)
|
|
SM.COM PIRATED Util -- Realia's SPACEMAKER utility
|
|
SMAP PIRATED Util -- IBM Internal utility, with the copyright
|
|
notice blanked out and real author's name
|
|
() replaced by "Dorn W. Stickle".
|
|
SPYHUNT PIRATED Game -- Spy Hunter Game.
|
|
STARGATE.EXE PIRATED Game -- Hacked to say "PUBLIC DOMAIN BY ATARI,"
|
|
but don't you believe it! Be careful not
|
|
to confuse this 57 KB .EXE file with the
|
|
public domain STARGATE MERCHANT game,
|
|
which is a little 12 KB BASIC program
|
|
by G. E. Wolfworth.
|
|
STRIPKR PIRATED Game -- Strip Poker by Artworx
|
|
SUPERCAD PIRATED Misc -- Easy CAD, a drawing program -- LQR file
|
|
size is 242,660 bytes
|
|
SUPERKEY PIRATED Misc -- Superkey macro program
|
|
THEQUEST.BAS/EXE PIRATED Game -- The Quest
|
|
TIRES.EXE PIRATED Game -- Again, really bc's quest for tires
|
|
TEMPOFAP PIRATED Game -- Temple of Apshai
|
|
ULTIII PIRATED Game -- Ultima 3
|
|
UTILITY PIRATEd Util -- Norton's Utilities Arced and with the file
|
|
names changed. When run, however, the
|
|
programs display the copyright notice of
|
|
Peter Norton. Many other pirated utils
|
|
could also go under the name UTILITY.
|
|
VS PIRATED Util -- Also INTECHS DOSMENU
|
|
WCKARATE PIRATED Game -- World Championship karate by epyx
|
|
XDIR PIRATED Util -- Pre-release version of DOS FILE TRACKER
|
|
XTREE PIRATED Util -- IBM's tree utility, an IBM "Personally
|
|
Developed" program.
|
|
ZAXXON PIRATED Game -- Hacked (sound familiar?) to say "PUBLIC
|
|
DOMAIN BY SEGA." Sorry, Charlie!
|
|
|
|
----------------------------------------------------------------------------
|
|
| MISCELLANEOUS ILLEGAL FILES: |
|
|
----------------------------------------------------------------------------
|
|
|
|
COPYWRIT MISC Patch -- Although the real COPYWRITE is going around
|
|
Bulletin Boards like fire, there is another
|
|
illegal file under the same name.
|
|
The former takes around 40 KB ARC-ed,
|
|
whereas this takes about 2 KB.
|
|
What I'm referring to is an archive of
|
|
1-3 files that explains how to remove
|
|
the serial numbers from copywrite. Now
|
|
it's alright to "unprotect" a program
|
|
for backup purposes, but removing serial
|
|
numbers can only lead to piracy.
|
|
LOCKPICK MISC Text -- This is a text file, usually with a
|
|
.TXT extension, that casually explains
|
|
how to pick locks. I'm not sure
|
|
whether this is illegal, but it's
|
|
definitely in poor taste.
|
|
XTALK MISC Patch -- Like Copywrite, there is a patch circulating
|
|
BBS's to remove the serial numbers from
|
|
Crosstalk.
|
|
|
|
|
|
|
|
|
|
----------------------------------------------------------------------------
|
|
| Many thanks to generous, continuous update contributions from: |
|
|
----------------------------------------------------------------------------
|
|
| |
|
|
| |
|
|
| 1. THE SOURCE information service. |
|
|
| 2. You? |
|
|
----------------------------------------------------------------------------
|
|
|
|
|
|
|
|
|
|
|
|
This is the end of the "bad files list." The rest of this document
|
|
contains instructions on what to do if YOU run a trojan horse, an update
|
|
history, a glossary, and information on how and where to contact me with
|
|
updates.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
----------------------------------------------------------------------------
|
|
| If you run a trojan horse.. |
|
|
----------------------------------------------------------------------------
|
|
|
|
|
|
|
|
The first thing to do after running what you think to be a trojan horse is
|
|
diagnose the damage. Was your [hard] drive formatted? Did the trojan scramble
|
|
your FAT table? Did every file get erased? Did your boot sector on the [hard]
|
|
drive get erased/formatted? Odds are that the trojan incurred one of these
|
|
.More..
|
|
|
|
four disasters.. After the initial diagnosis, you are ready to remedy the
|
|
problem. Bear in mind that there is no better remedy for a drive that has
|
|
run a trojan horse than a recent backup..
|
|
|
|
|
|
1) If the trojan FORMATTED your hard disk:
|
|
There is only one way out of this mess, and that is to use the
|
|
MACE+ utilities by Paul Mace. MACE+ has two devices in it to
|
|
recover formatted disks, and believe me, they work! More about
|
|
MACE+ later.
|
|
|
|
2) If your FAT got scrambled:
|
|
there is nothing to do. However, there Is a program called
|
|
FATBACK.COM (available on my board) that will back up your FAT
|
|
table in under a minute to floppy. Using FATBACK, it is easy
|
|
and non time consuming to back up your FAT regularly.
|
|
|
|
3) If file(s) got erased, and the FAT table is undamaged:
|
|
There are many packages to "undelete" deleted files. Norton
|
|
Utilites, PC-tools, MACE+, and UNDEL.COM will all do the job.
|
|
|
|
I recommend the first three, but they are more expensive than
|
|
the Public Domain program UNDEL.COM. When you are undeleting,
|
|
be sure to undelete files in the order of last time written to
|
|
disk. PC-tools for one automatically lists "undeletable" files
|
|
in the correct order, but the other three may not.
|
|
|
|
4) If the boot sector on your [hard] disk gets erased/formatted:
|
|
There are four things to do if this happens, and the worst that
|
|
can happen is that you will go without a [hard] disk for a while.
|
|
To be on the safest side, back up everything before even proceeding
|
|
to step "A," although I can not see why it would be necessary.
|
|
|
|
A) Try doing a "SYS C:" (or "SYS A:") from your original DOS disk,
|
|
and copy COMMAND.COM back onto the [hard] drive after that.
|
|
Try booting and if that doesn't work try step B.
|
|
|
|
B) If you have the MACE+ utilities go to the "other utilities"
|
|
section and "restore boot sector." This should do the job
|
|
if you have been using MACE+ correctly.
|
|
|
|
|
|
C) If you are still stuck, BACK EVERYTHING UP and proceed to do a
|
|
low level format. Instructions on how to perform a low-level
|
|
format should come with your [hard] disk controller card.
|
|
Be sure to map out bad sectors using either SCAV.COM by Chris
|
|
Dunford or by manually entering the locations of bad sectors
|
|
into the low level format program. After the low level format,
|
|
if your have a hard disk, run FDISK.COM (it comes with DOS)
|
|
and create a DOS partition. Refer to your DOS manual for help
|
|
in using FDISK. Then put your original DOS diskette in drive A:
|
|
and do a FORMAT <drive letter>:/S/V. Drive letter can stand for
|
|
"C" or "B" depending on whether you are reformatting a hard disk
|
|
or not. Finally you are ready to attempt a reboot.
|
|
|
|
D) If you are still stuck, either send your drive away to be fixed
|
|
by professionals, or live with a non-bootable [hard] drive..
|
|
|
|
|
|
|
|
By now you may be saying to yourself:
|
|
|
|
|
|
"how can I get a hold of a 'MACE+' utilities package so that I can guard
|
|
against trojans? Why, MACE+ can recover a formatted drive, undelete files,
|
|
and restore boot sectors! I want to get it!"
|
|
|
|
OK, there are two ways to get ahold of these marvelous utilities. One is to
|
|
call up the Paul Mace Software Company (tm) and order them at a retail of
|
|
$ 79.95. The other is place an order for them at the WEST LOS ANGELES
|
|
PC-STORE for $ 49.95. The PC-STORE supports next day UPS shipping, so you can
|
|
be assured of getting the utilities fast. The BBS phone # for the PC-STORE is
|
|
at the end of this document.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
----------------------------------------------------------------------------
|
|
| Update History: |
|
|
----------------------------------------------------------------------------
|
|
|
|
Version 1.0 Plans were drawn up for a "bad file" list and a dozen
|
|
bad files were entered in the list.
|
|
Version 2.0 Saw the addition of a short introduction and about 10
|
|
more files.
|
|
Version 3.0 Here Tom Neff and I started collaborating on the Dirty
|
|
Dozen. About 20 files were added, and the introduction
|
|
was completely re-written.
|
|
|
|
Version 4.0 By this time I totally took over responsibility
|
|
of the DD, as Tom Neff lost interest. Another 30 or
|
|
so files were added to the list, making the DD 65+
|
|
files strong. A few more additions to the introduction.
|
|
|
|
Version 5.0 By the time version 5.0 was released, the Dirty Dozen
|
|
was being greeted favorably and with enthusiasm
|
|
around the country. Updates started coming in with
|
|
regularity; the list prospered (if one can say that
|
|
about a list!). A few more paragraphs were added to
|
|
the introduction, and 40 new files were bringing the
|
|
file total up to 103!
|
|
|
|
Version 6.0 The Dirty Dozen has gotten to be such a big project that
|
|
I am now writing it in stages. Although I am going to
|
|
make absolutely no effort to spread these "intermediate
|
|
versions," they will always be downloadable from my board.
|
|
This way if anyone so desires, they may keep an extremely
|
|
current issue of the DD, although the changes will only be
|
|
minor. You might think of stage "a" of issue #6 as version
|
|
6.1, stage "b" as version 6.2, stage "c" as version 6.3.
|
|
|
|
|
|
New in version 6.0 is the following:
|
|
A) Many minor revisions,
|
|
B) 17 more files, bringing the total to 120!
|
|
C) Two new paragraphs in the introduction,
|
|
D) Instructions on how to recover from a trojan horse,
|
|
E) A comprehensive glossary,
|
|
F) This update history,
|
|
G) An acknowledgments section set up for major contrib-
|
|
utors of information regarding new bogusware,
|
|
H) A new bogusware catagory of "miscellaneous
|
|
illegal software."
|
|
|
|
|
|
|
|
----------------------------------------------------------------------------
|
|
| Glossary: |
|
|
----------------------------------------------------------------------------
|
|
| |
|
|
| This glossary is aimed at the beginning to intermediate user, |
|
|
| so if you are experienced, reading the whole thing will only bore you.. |
|
|
| |
|
|
----------------------------------------------------------------------------
|
|
|
|
|
|
|
|
?Q? -- (? standing for any character). File extension for SQueezed
|
|
files. Squeezed files are unusable until unsqueezed by a
|
|
utility such as NUSQ.COM or USQ.COM. The advantage of a
|
|
SQueezed file is that it is smaller than a regular UnSQueezed
|
|
file, thus saving disk space and download time. ARChives are
|
|
more efficient than Squeezed files; that's why there are so
|
|
many more ARChives on BBS's these days. Example of the
|
|
extensions of SQueezed files: .EQE, .CQM, .LQR, .TQT,
|
|
.DQC, etc.
|
|
ABBR -- abbreviation for the word: "abbreviation"
|
|
ARC -- File extension for an ARChive file -- many files combined
|
|
together to save space and download time that require ARC.EXE,
|
|
PKXARC.COM, ARCE.COM, or ARCLS.EXE to separate the
|
|
files in to "runnable" and "readable" (in the case of
|
|
text) form.
|
|
BAS -- abbr "BASIC," as in the programming language
|
|
BBS -- abbr "Bulletin Board System"
|
|
BBS's -- abbr "Bulletin Board Systems"
|
|
BOARD -- Also "Bulletin Board System"
|
|
BOGUSWARE -- software that is damaging to one or more parties
|
|
BOOT or -- to "boot" up a computer is to restart it from scratch, erasing
|
|
REBOOT all TSR programs. Rebooting is performed by either powering
|
|
off and then on, or pressing ctrl-alt-del at the same time.
|
|
BYTES -- Bytes are used to measure the length of a file, with one
|
|
byte equaling one character in a file.
|
|
COM -- file extension for a file that is executable from DOS level
|
|
DD -- abbr "dirty dozen"
|
|
DOC -- abbr "documentation"
|
|
EXE -- file extension for a file that is executable from DOS level
|
|
HACKED -- see "definitions" section
|
|
IBM -- International Business Machines
|
|
IBM OR COMP -- IBM computer or a 99% or greater IBM Compatible computer
|
|
KB -- Abbreviation for "KiloBytes," one Kb equals 1024 bytes
|
|
LBR -- Extension on Library files. Library files are really
|
|
many combined files like ARChives, but they require
|
|
different utilities to extract the individual files.
|
|
Some examples of such utilities are LUU.EXE, LUE.EXE,
|
|
LAR.EXE, AND ZIP.EXE. See "ARC"
|
|
MB -- abbr "Megabytes," or "millions of bytes."
|
|
MISC -- abbr "miscellaneous"
|
|
OPTIMIZE -- to make all files on a disk "contiguous," or physically linked
|
|
together on a [hard] drive.
|
|
PATCH -- a file that is patched (combined) into another file
|
|
to change the original file in some way
|
|
PD -- abbr "Public Domain"
|
|
PIRATED -- see "definitions" section in this issue.
|
|
RAM -- abbr "Random Access Memory." (memory used by software)
|
|
RBBS -- abbr RBBS-PC, a type of BBS. [Remote Bulletin Board System]
|
|
ROM -- abbr "Read Only Memory." (memory used by hardware to boot)
|
|
SYSOP -- SYStem OPerator of a BBS
|
|
*TROJAN* -- see "definitions" section in this issue.
|
|
TROJAN HORSE -- see "definitions" section in this issue.
|
|
TSR -- abbr "Terminate, Stay Resident" Synonym = "Memory Resident"
|
|
TXT -- abbr "text"
|
|
USU -- abbr "usually"
|
|
UNP -- abbr "unprotect"
|
|
UNPROTECT -- an "unprotect file" is a patch file that results in the
|
|
breaking of copy protection (no doubt for back up purposes).
|
|
UTIL -- abbr "utility"
|
|
WORM -- Trojan Horse
|
|
|
|
|
|
|
|
|
|
----------------------------------------------------------------------------
|
|
| Finally: |
|
|
----------------------------------------------------------------------------
|
|
|
|
|
|
If you have any additions or corrections for this list, send them to
|
|
Eric Newhouse at any of the following places: (in order of most frequented)
|
|
|
|
|
|
* The Crest RBBS (213-471-2518) (2400/1200) (80 MB)
|
|
[ This is my board ]
|
|
|
|
|
|
|
|
* The West LA PC-HOST (213-559-6954) (2400/1200/300) (50 MB)
|
|
|
|
* VOR bbs (415-994-2944) (2400/1200/300) (20 MB)
|
|
|
|
* The Source (leave E-mail to "Doctor File Finder" in IBM SIG #4)
|
|
Doctor File Finder (Mike Callahan) will relay your name
|
|
and update information to me.
|
|
|
|
----------------------------------------------------------------------------
|
|
End of file.
|