531 lines
28 KiB
Plaintext
531 lines
28 KiB
Plaintext
----------------------------------------------------------------
|
|
| THE GUARDIAN LIST |
|
|
| |
|
|
| -- An Abbreviated Trojan Alert List |
|
|
| to be used as a BULLETIN on BBS's |
|
|
----------------------------------------------------------------
|
|
| Issue #01: November 12, 1989|
|
|
| By Tom Sirianni, |
|
|
| and Those Sysops of FidoNet & LCRNET Revision Stage `C'|
|
|
----------------------------------------------------------------
|
|
|
|
NAME CATEGORY NOTES
|
|
-------------- -------- ---------------------------------------
|
|
|
|
3X3SHR *TROJAN Time Bomb type trojan wipes the [Hard]
|
|
Drive clean. File size is 78,848.
|
|
|
|
ANTI-PCB *TROJAN The story behind this trojan horse is
|
|
sickening. Apparently one RBBS-PC
|
|
sysop and one PC-BOARD sysop started
|
|
feuding about which BBS system was
|
|
better, and in the end the PC-BOARD
|
|
sysop wrote a trojan and uploaded it to
|
|
the rbbs SysOp under ANTI-PCB.COM. Of
|
|
course the RBBS-PC SysOp ran it, and
|
|
that led to quite a few accusations and
|
|
a big mess in general. Let's grow up!
|
|
Every SysOp has the right to run the
|
|
type of BBS they please, and the fact
|
|
that a SysOp actually wrote a trojan
|
|
ntended for another sysop simply
|
|
blows my mind.
|
|
|
|
ARC2ZIP.EXE VIRUS This Lehigh Virus strain that attacks
|
|
the COMMAND.COM and is used in
|
|
converting ARCed files to ZIPed files.
|
|
This file also copies itself into the
|
|
ZIPed file while remaining a TSR within
|
|
COMMAND.COM. Also it is always looking
|
|
for COMMAND.COM on a FLOPPY diskette, so
|
|
it has two ways to infect.
|
|
|
|
ARC513.EXE *TROJAN This hacked version of ARC appears
|
|
normal, so beware! It will write over
|
|
track 0 of your [hard] disk upon usage,
|
|
destroying the disk.
|
|
|
|
ARC514.COM *TROJAN This is very similar to ARC version
|
|
5.13 in that it will overwrite track 0
|
|
(FAT Table) of your [Hard] disk. Also, I
|
|
have yet to see an .EXE version of this
|
|
program.
|
|
|
|
ARC533.EXE VIRUS This is a new Virus program designed to
|
|
emulate Sea's ARC program. It infects
|
|
OMMAND.COM. Lehigh Virus Type.
|
|
|
|
BACKTALK *TROJAN This program used to be a good PD
|
|
utility, but someone changed it to be
|
|
trojan. Now this program will write/
|
|
destroy sectors on your [hard] disk
|
|
drive. Use this with caution if you
|
|
acquire it, because it's more than
|
|
likely that you got a bad copy.
|
|
|
|
B30012A.ARC *TROJAN Was supposed to be a Quick BBS utilty
|
|
to handle 300 baud Users. But what it
|
|
really does is delete many of the
|
|
general directories used by a Quick
|
|
BBS system.
|
|
|
|
CDIR.COM *TROJAN This program is supposed to give you a
|
|
color directory of files on your disk,
|
|
but it in fact will scramble your disk's
|
|
File Allocation Table (FAT).
|
|
|
|
D-XREF60.COM TROJAN A Pascal Utility used for Cross-
|
|
Referencing, written by the infamous
|
|
Dorn Stickel. It eats the FAT and
|
|
BOOT sector after a time period has
|
|
been met and if the [Hard] Drive is more
|
|
than half full.
|
|
|
|
DANCERS.BAS *TROJAN This trojan shows some animated dancers
|
|
in color, and then proceeds to wipe out
|
|
your [hard] disk's FAT table. There is
|
|
another perfectly good copy of DANCERS.
|
|
BAS on BBS's around the country; appar-
|
|
ently the idiot trojan author altered a
|
|
legitimate program to do the dirty work.
|
|
|
|
DISKSCAN.EXE TROJAN This was a PC-MAGAZINE program to scan
|
|
a [hard] disk for bad sectors, but then
|
|
a joker edited it to WRITE bad sectors
|
|
Also look for this under other names
|
|
such as SCANBAD.EXE and BADDISK.EXE. A
|
|
good original copy is availble on SCP
|
|
Business BBS.
|
|
|
|
DMASTER *TROJAN This is yet another FAT scrambler.
|
|
|
|
DOSKNOWS.EXE *TROJAN I'm still tracking this one down --
|
|
apparently someone wrote a FAT killer
|
|
and renamed it DOSKNOWS.EXE, so it
|
|
would be confused with the real,
|
|
harmless DOSKNOWS system-status
|
|
utility. All I know for sure is that
|
|
the REAL DOSKNOWS.EXE is 5376 bytes
|
|
long. If you see something called
|
|
DOSKNOWS that isn't close to that size,
|
|
sound the alarm.
|
|
|
|
DOS-HELP TROJAN This trojan, when made memory-resident,
|
|
is supposed to display a DOS command
|
|
that the User needs help with. Works fine
|
|
on a Diskette system, but on a [Hard]
|
|
DRIVE system, it tries to format the
|
|
[Hard] Disk with every access of
|
|
DOS-HELP.
|
|
|
|
DPROTECT *TROJAN Apparently someone tampered with the
|
|
original, legitimate version of
|
|
DPROTECT and turned it into a FAT
|
|
eater. A good version is available
|
|
on SCP Business BBS.
|
|
|
|
DRAIN2 *TROJAN There really is a DRAIN program, but
|
|
this revised program goes out does a Low
|
|
Level Format while it is playing the
|
|
funny program.
|
|
|
|
DROID.EXE *TROJAN This trojan appears under the guise of
|
|
a game. You are supposedly an architect
|
|
who controls futuristic droids in search
|
|
of relics. In fact, PC-Board sysops (if
|
|
they run this program from C:\PCBOARD)
|
|
will find that it copies C:\PCBOARD\
|
|
PCBOARD.DAT to C:\PCBOARD\HELP\HLPX. The
|
|
.EXE file is 54,272 bytes.
|
|
|
|
DRPTR.ARC TROJAN File found on two boards in the 343
|
|
Net. After running unsuspected file,
|
|
the only things left in the Sysop's
|
|
root directory were the subdirectories
|
|
and two of the three DOS System files,
|
|
along with a 0-byte file named
|
|
WIPEOUT.YUK. The Sysop's COMMAND.COM
|
|
was located in a different directory;
|
|
the file date and CRC had not changed.
|
|
|
|
DSZ (Patch) *CAREFUL The author of this protocol program,
|
|
Chuck Forsberg, warns that anyone using
|
|
an Unregistered version of DSZ that was
|
|
HACKED with a downloaded PATCH to make
|
|
it work fully, might get a SCRAMBLED FAT.
|
|
Seems someone created the HACK PATCH and
|
|
then uploaded it to BBS's. *BEWARE* of
|
|
the PATCH! It is not the DSZ program that
|
|
does the dirty work, but the invalid PATCH.
|
|
|
|
EGABTR *TROJAN BEWARE! Description says something like
|
|
"improve your EGA display," but when
|
|
run, it deletes everything in sight and
|
|
prints, "Arf! Arf! Got you!"
|
|
|
|
EMMCACHE *CAREFUL This program is not exactly a trojan,
|
|
but it (v. 1.0) may have the capability
|
|
of destroying [Hard] disks by:
|
|
A) Scrambling every file modified after
|
|
running the program.
|
|
B) Destroying boot sectors.
|
|
This program has damaged at least two
|
|
[Hard] disks; yet there is a base of
|
|
happily registered users. Therefore,
|
|
extreme caution is advised if you decide
|
|
to use this program.
|
|
|
|
FILER.EXE *TROJAN One SysOp complained a while ago that
|
|
this program wiped out his 20 Megabyte
|
|
[Hard] disk. I'm not so sure that he was
|
|
correct and/or telling the truth any
|
|
more. I have personally tested an
|
|
excellent file manager also named
|
|
FILER.EXE, and it worked perfectly.
|
|
Also, many other SysOp's have written
|
|
to tell me that they have like me used
|
|
a FILER.EXE with no problems. If you
|
|
get a program named FILER.EXE, it is
|
|
probably alright, but better to test it
|
|
first using some security measures.
|
|
|
|
FILES.GBS CAREFUL When an OPUS BBS system is installed
|
|
improperly, this file could spell
|
|
disaster for the Sysop. It can let a
|
|
user of any level into the system.
|
|
Protect yourself. Best to have a
|
|
sub-directory in each upload area
|
|
called c:\upload\files.gbs (this is an
|
|
example only). This would force Opus to
|
|
rename a file upload of files.gbs and
|
|
prevent its usage.
|
|
|
|
FINANCE4.ARC *CAREFUL This program is not a verified trojan;
|
|
there is simply a file going around
|
|
BBS's warning that it may be a trojan.
|
|
In any case, exercise extreme care with
|
|
it.
|
|
|
|
FLU4TXT.COM TROJAN Man, when I thought we had it licked!
|
|
This Trojan was inserted into the
|
|
FluShot4.ARC and uploaded to many
|
|
BBS's. FluShot is a protector of your
|
|
COMMAND.COM. The author of FluShot
|
|
posted this Trojan warning, and I am
|
|
posting it here in the GL. If you need
|
|
a good copy, you can get it from here--
|
|
SCP Business BBS--or on COMPUSERVE.
|
|
|
|
FOX2.ARC TROJAN The show program was put into the FOX
|
|
(SHOW.COM) archive to display a porono on VGA.
|
|
While doing so it corrupts the FAT of
|
|
the HD. Even NU can not recover it. A
|
|
FAT recover program like MIRROR has
|
|
not yet been tested for it.
|
|
Name Size Date
|
|
Show.com 14562 06/02/85
|
|
|
|
FUTURE.BAS *TROJAN This "program" starts out with a very
|
|
nice color picture (of what, I don't
|
|
know) and then proceeds to tell you
|
|
that you should be using your computer
|
|
for better things than games and
|
|
graphics. After making that point, it
|
|
trashes your A: drive, and B:, C:, D:
|
|
drives until it has erased all drives.
|
|
It does not go after the FAT alone; it
|
|
also erases all of your data. As far
|
|
as I know, however, it erases only one
|
|
sub-directory tree level deep, thus
|
|
[Hard] disk users should only be
|
|
seriously affected if they are in the
|
|
"root" directory. I'm not sure about
|
|
this one either, though.
|
|
|
|
GATEWAY2 *TROJAN Someone tampered with version 2.0 of
|
|
the CTTY monitor GATEWAY. What it
|
|
does is ruin the FAT. If you need a
|
|
good copy, you can file-request it or
|
|
pick one up from 105/301--SCP Business
|
|
BBS.
|
|
|
|
GRABBER TROJAN This program is supposed to be a SCREEN
|
|
CAPTURE program that copies the screen
|
|
to a .COM to be run later from the DOS
|
|
command line. As a TSR, it will also
|
|
attempt to do a DISK WRITE to the [Hard]
|
|
drive when you do not want it to. It
|
|
will wipe whole Directories when doing
|
|
a normal DOS command. One sysop who
|
|
ran it lost all of his ROOT directory
|
|
including his SYSTEM files. The file
|
|
status is :
|
|
Name Size Date Time
|
|
GRABBER.COM 2583 05/28/87 22:10
|
|
|
|
GRASPRT.EXE VIRUS This file was in a porno file called
|
|
SEXSHOE.LZH originating from PC-EXEC
|
|
BBS. The Sysop took it off, but it had
|
|
been downloaded by a few people. This is
|
|
one of the Jerusalem-B Virus strains.
|
|
The status is:
|
|
Name Size Date Time
|
|
GRASPRT.EXE 73376 06/03/86 09:49
|
|
|
|
G-MAN TROJAN Another FAT killer.
|
|
|
|
HEART.EXE VIRUS Infected with the Israeli Virus.
|
|
Displays the HEART logo on CGA monitor
|
|
while infecting the HD. File is found
|
|
on some SHAREWARE houses watch for it.
|
|
Name Size Date
|
|
HEART.EXE 13744 ?????
|
|
|
|
JIV40.LZH VIRUS Hacked propgram of JIV - current real
|
|
program is v3.3 NOT v4.0 - It is also
|
|
infected by a Virus which attaches to
|
|
any .COM file it can find.
|
|
|
|
KC-PAL.COM TROJAN Infects the COMMAND.COM and then attaches
|
|
to any .COM file afterward using the
|
|
COMMAND.COM during its use of Internal
|
|
commands (COPY, DIR, TYPE, etc.). The
|
|
COMMAND.COM files are enlarged in size
|
|
by 1538 bytes, and in the Time column
|
|
of the directory, listing the seconds
|
|
is reset from :00 to :62.
|
|
|
|
LM TROJAN Deletes the COMMAND.COM and other
|
|
files from the ROOT directory of the
|
|
[Hard] Drive when the program runs.
|
|
|
|
MAP TROJAN This is another trojan horse written by
|
|
the infamous Dorn Stickel. Designed
|
|
to display what TSR's are in memory and
|
|
works on FAT and BOOT sectors. Also
|
|
seems towork only when the [Hard] Drive
|
|
is 50 percent full or more.
|
|
|
|
MATHKIDS.ARC *TROJAN This is a fairly benign trojan that
|
|
will not reformat your [Hard] disks or
|
|
do any system-level damage. Instead,
|
|
it is designed to crack a BBS system. It
|
|
will attempt to copy the USER file on
|
|
a BBS to a file innocently called
|
|
FIXIT.ARC, which the originator can
|
|
later call in and download. Believed
|
|
to be designed for PCBoard BBS's.
|
|
|
|
MOUSEKEY.COM VIRUS Mouse device program infected with the
|
|
CASCADE type virus.
|
|
|
|
NORTSHOT.ZIP TROJAN A supposed VIRUS checker - while
|
|
NORTSTOP.ZIP listing the DIR during its check
|
|
displays that the disk is Virus Free -
|
|
but during Dec. 24th and Dec. 31st it
|
|
will ERASE files in several DIR's
|
|
based on their extension. NORTSHOT.ZIP
|
|
and NORTSTOP.ZIP are same file.
|
|
Name Size Date
|
|
NORTSTOP.EXE 38907 ?????
|
|
|
|
NOTROJ.COM *TROJAN This "program" is the most sophisti-
|
|
cated trojan horse that I've seen to
|
|
date. All outward appearances indicate
|
|
that the program is a useful utility
|
|
used to FIGHT other trojan horses.
|
|
Actually, it is a time bomb that erases
|
|
any [Hard] disk FAT IT can find and,
|
|
at the same time, it warns: "another
|
|
program is attempting a format, can't
|
|
abort! After erasing the FAT(s),
|
|
NOTROJ then proceeds to start a low
|
|
level format. One extra thing to note:
|
|
NOTROJ only damages FULL [Hard] drives;
|
|
if a [Hard] disk is under 50 percent
|
|
full, this program won't touch it!
|
|
If you are interested in reading a
|
|
thorough report on NOTROJ.COM, James H.
|
|
Coombes has written an excellent text
|
|
file on the matter named NOTROJ.TXT.
|
|
If you have trouble finding it, you
|
|
can get it from SCP Business BBS.
|
|
|
|
PACKDIR *TROJAN This utility is supposed to "pack"
|
|
(sort and optimize) the files on a
|
|
[hard] disk, but apparently it
|
|
scrambles FATs.
|
|
|
|
PCW271xx.ARC *TROJAN A modified version of the popular
|
|
PC-WRITE word processor (v. 2.71) has
|
|
now scrambled at least 10 FAT tables
|
|
that I know of. If you want to
|
|
download version 2.71 of PC-WRITE, be
|
|
very careful! The bogus version can be
|
|
identified by its size; it uses 98,274
|
|
bytes whereas the good version uses
|
|
98,644. For reference, version 2.7 of
|
|
PC-WRITE occupies 98,242 bytes.
|
|
|
|
PKX35B35.ARC } *TROJAN This was supposed to be an update to
|
|
PKB35B35.ARC } *VIRUS PKARC file compress utility. When it is
|
|
run, it *EATS your FATS* and is said to
|
|
to infect other files so it can spread.
|
|
Possible VIRUS.
|
|
|
|
PKPAK/PKUNPAK *CAREFUL There is a TAMPERED version of 3.61
|
|
v3.61 that interferes with PC's interrupts.
|
|
|
|
PKFIX361.EXE *TROJAN Supposed patch to v3.61. What it really
|
|
does when it is extracted from the .EXE
|
|
file is do DIRECT access to the DRIVE
|
|
CONTROLLER to perform a Low-Level format,
|
|
thereby bypassing checking programs.
|
|
|
|
PK362.EXE *CAREFUL This is a NON-RELEASED version and is
|
|
suspected as being a *TROJAN*. Not
|
|
verified.
|
|
|
|
PK363.EXE *CAREFUL This is a NON-RELEASED version and is
|
|
suspected as being a *TROJAN*. Not
|
|
verified.
|
|
|
|
PKZ100.EXE TROJAN Supposed to be a new release of PKZIP,
|
|
but what it really does is fill up
|
|
your [Hard] drive with many directories
|
|
until the system no longer functions.
|
|
The current version is PKZIP v.092.
|
|
|
|
PKZ120.EXE TROJAN Modeifies the AREAS.BBS of BBS's that
|
|
use such a file. Replaces addreses in
|
|
that file with dummy addreses. then
|
|
deletest itself to avoid any way to
|
|
desipher how it works.
|
|
Name Size Date
|
|
PKZ120.EXE 172,000approx. 09/13/89
|
|
|
|
QUIKRBBS.COM *TROJAN This Trojan horse advertises that it
|
|
will install a program to protect your
|
|
RBBS but it does not. It goes and eats
|
|
away at the FAT instead.
|
|
|
|
QUIKREF *TROJAN This ARChive contains ARC513.COM.
|
|
It is supposed to load RBBS-PC's message
|
|
file into memory two times faster than
|
|
normal. What it really does is copy the
|
|
RBBS-PC.DEF into an ASCII file named
|
|
HISCORES.DAT.
|
|
|
|
RCKVIDEO *TROJAN This is another trojan that does what
|
|
it's supposed to do, and then wipes out
|
|
[Hard] disks. After showing some simple
|
|
animation of a rock star ("Madonna," I
|
|
think), the program will go to work on
|
|
erasing every file it can lay it's
|
|
hands on. After about a minute of this,
|
|
it will create three ASCII files that
|
|
say, "You are stupid to download a
|
|
video about rock stars," or something
|
|
of the like.
|
|
|
|
SECRET.BAS *TROJAN BEWARE!! This may be posted with a note
|
|
saying it doesn't seem to work, and
|
|
would someone please try it; when you
|
|
do, it formats your disks.
|
|
|
|
SIDEWAYS.COM *TROJAN Be careful with this trojan; there is a
|
|
perfectly legitimate version of
|
|
SIDEWAYS.EXE circulating. Both the
|
|
trojan and the good SIDEWAYS advertise
|
|
that they can print sideways, but
|
|
SIDEWAYS.COM will trash a [hard] disk's
|
|
boot sector instead. The trojan .COM
|
|
file is about 3 KB, whereas the
|
|
legitimate .EXE file is about 30 KB
|
|
large.
|
|
|
|
STAR.EXE *TROJAN Beware RBBS-PC SysOps! This file puts
|
|
some stars on the screen while copying
|
|
RBBS-PC.DEF to another name that can be
|
|
downloaded later!
|
|
|
|
STRIPES.EXE *TROJAN Similar to STAR.EXE, this one draws an
|
|
American flag (nice touch), while it's
|
|
busy copying your RBBS-PC.DEF to
|
|
another file (STRIPES.BQS) so the joker
|
|
can log in later, download STRIPES.BQS,
|
|
and steal all your passwords. Nice, huh?
|
|
|
|
SUG.COM TROJAN This one is supposed to go out and
|
|
unprotect copy protected programs disks
|
|
by Softguard Systems, Inc. After it
|
|
trashes your disk, it comes back and
|
|
displays:
|
|
"This destruction constitutes a prima
|
|
facie evidence of your violation. If
|
|
you attempt to challenge Softguard
|
|
Systems Inc..., you will be vigorously
|
|
counter-sued for copyright infringement
|
|
and theft of services."
|
|
AND it by-passes any attempt by CHK4BOMB
|
|
to search for the any hidden messages
|
|
that tell you, "YOU BEEN HAD... or
|
|
GOTCHA>>> Ar..Ar..Ar... It encrypts the
|
|
Gotcha message so no Trojan checker can
|
|
scan for it.
|
|
|
|
TIRED *TROJAN Another scramble-the-FAT trojan by Dorn
|
|
W. Stickel.
|
|
|
|
TOPDOS *TROJAN This is a simple high level [hard] disk
|
|
formatter.
|
|
|
|
TSRMAP *TROJAN This program does what it's supposed to
|
|
do: give a map outlining the location
|
|
(in RAM) of all TSR programs, but it
|
|
also erases the boot sector of drive
|
|
"C:".
|
|
|
|
ULTIMATE.EXE TROJAN Another FAT eater. File status:
|
|
Name Size
|
|
ULTIMATE.EXE 3090
|
|
ULTIMATE.ARC 2432
|
|
|
|
UNIX VIRUS The UNIX operating system by Berkley,
|
|
verson 4.3, is an INTERNET virus. A
|
|
Patch is available on SCP Business
|
|
BBS. This is the MAIL PACKET VIRUS.
|
|
|
|
VDIR.COM *TROJAN This is a disk killer that Jerry
|
|
Pournelle wrote about in BYTE Magazine.
|
|
I have never seen it, although a
|
|
responsible friend of mine has.
|
|
|
|
VGA2CGA.ARC VIRUS CGA converter - infected with the
|
|
AIDS/Hahaha - has been found on many
|
|
USA West Coast BBS's.
|
|
|
|
VU.EXE *VIRUS Infected with the 1704-B Virus. Has not
|
|
been confirmed. And is unkown what the
|
|
file is supposed to do.
|
|
|
|
WOW *VIRUS Also known as the 1701 Virus. This
|
|
is a new strain of the Lehigh Virus
|
|
as it not only looks for COMMAND.COM,
|
|
but any .COM file. As it does it, the
|
|
infected file is enlarged 1,701 bytes
|
|
in SIZE. The infection takes as you
|
|
run the .COM. WOW is a TSR. What happens
|
|
when you run WOW is that it displays an
|
|
advertisement:
|
|
""The Wizards of Warez"
|
|
in assocoation with
|
|
the copycats
|
|
the Pirates Unlimited
|
|
OUTRUN
|
|
WOW 1989 "
|
|
The virus is also known as WOWTITLE.
|
|
|
|
|
|
<< END OF ABBREVIATED LIST>>
|