1551 lines
78 KiB
Plaintext
1551 lines
78 KiB
Plaintext
------------------------------------------------------------------
|
|
| |
|
|
| THE DIRTY DOZEN -- An Uploaded Program Alert List |
|
|
| |
|
|
------------------------------------------------------------------
|
|
| Issue #8: April 4, 1988 |
|
|
| |
|
|
| Revision stage 'B' |
|
|
| |
|
|
| Maintained by Eric Newhouse |
|
|
| Originally by Tom Neff |
|
|
------------------------------------------------------------------
|
|
|
|
|
|
Recently, many unlawfully copied or modified programs have
|
|
appeared on various IBM bulletin boards across the country.
|
|
THE DIRTY DOZEN lists known examples.
|
|
|
|
The author takes no responsibility for the validity or
|
|
completeness of this list. Many sources contribute to the list,
|
|
and it is very possible that one of the reported 'dirty' files
|
|
works perfectly and is in the Public Domain.
|
|
|
|
Also, users upload bad software to bulletin boards daily, and
|
|
often times that bad software is not yet in this list. In other
|
|
words, if you run a trojan horse that is not listed in here,
|
|
please don't call my board to complain; rather, leave me a message
|
|
so that I can place the destructive program in the next issue. If
|
|
you are unsure whether a file is trojan, and it's not listed in
|
|
here, then I recommend using a utility like BOMBSQAD.COM to
|
|
prevent any mishaps. Bombsqad, available on my board, catches
|
|
most trojan horses before they can damage your equipment.
|
|
|
|
There are five major categories of bad software: commercial
|
|
pirate jobs, unauthorized copies of otherwise legitimate freeware
|
|
programs, malicious "TROJAN" programs which damage your system,
|
|
"VIRII," which damage your and your friends' systems, and
|
|
miscellaneous illegal software. Please look in the definitions
|
|
section of this document for a more detailed explanation of these
|
|
terms.
|
|
|
|
SysOps: Please be careful with the files you post in your
|
|
download libraries! A professional quality program should arouse
|
|
your suspicions, especially if it doesn't include the author's
|
|
name, address, and distribution policy. Such programs are
|
|
probably NOT public domain! The BBS community is already under
|
|
legislative threat at the State and Federal level. We cannot
|
|
fight this trend effectively while our directories sit stocked
|
|
with cracked games, virii, and malicious "trojan horses!" Let's
|
|
demonstrate a little social responsibility by cleaning up our
|
|
download libraries. If you as a SysOp have any of these files on
|
|
your system, please delete them and post "blocking" dummy file
|
|
entries like this one:
|
|
|
|
|
|
ZAXXON.COM DELETED!! NOT PUBLIC DOMAIN!!
|
|
|
|
|
|
By working together to fight this new brand of software,
|
|
perhaps we can eliminate BBS pirates, trojan horse writers,
|
|
and legislation aimed at regulating BBS's.
|
|
|
|
The "Dirty Dozen" aims to bring this important issue to the
|
|
attention of more SysOps and users - to act as an information
|
|
"clearing-house" for the latest known examples of "bogusware."
|
|
Using information gleaned from the Dirty Dozen, an educated public
|
|
can fight effectively for safe downloadable files.
|
|
|
|
The Dirty Dozen needs your help to succeed! Please call in any
|
|
updates of bad software that you know of, but DO NOT modify this
|
|
article yourself. If everyone who discovers a pirated program
|
|
starts modifying the DD, there would be hundreds of issues in
|
|
circulation. If you have an update, please see the end of this
|
|
article for information on how to reach me with new information.
|
|
|
|
In addition, I would like to publicly apologize to Mr. Gerhard
|
|
Barth. In previous issues, I criticized him for distributing a
|
|
modified version of the dirty dozen. Thanks to a few messages
|
|
from Karl Brendel, I now know that Gerhard runs a fine well
|
|
maintained bulletin board that maintains copies of the true dirty
|
|
dozen. Gerhard, I'm sorry for any hassles I may have caused you.
|
|
|
|
One can be sure of only one thing about hard disks, and that is
|
|
that they will crash. Often times a user will blame a program for
|
|
a hard disk failure when in fact his problem lies in his/her
|
|
hardware. Remember, a Trojan rumor is much easier to START than
|
|
it is to STOP. Some people have accused legitimate *joke*
|
|
programs, such as DRAIN.COM (which pretends to be gurgling excess
|
|
water out of your A drive) of erasing their hard drive. If a
|
|
program locks up your system, it isn't necessarily Trojan; it
|
|
might not like co-residing with your graphics card or some TSR's.
|
|
Ask other users about the program in question before you dennounce
|
|
it as Trojan. Run the program again (on your empty drive) to
|
|
confirm its malicious intent. In short, make 100% sure that the
|
|
program is trojan before ruining the author's reputation. Also, I
|
|
would appreciate a bagged specimen of any real Trojan program that
|
|
you might have the (un)luck to find.
|
|
|
|
A user of mine has notified me that some pirates have patched
|
|
HARDHAT.COM and PANGO.COM to read "cracked by Eric Newhouse."
|
|
This is ridiculous! Please disregard any programs that you may
|
|
come across in the future advertising "copy protection busted by
|
|
Eric Newhouse." Pirates are simply trying to discourage me
|
|
from publishing this list.
|
|
|
|
Recently someone asked me why pirates don't rename commercial
|
|
files inorder to fool SysOps. They do! For example, AUTODEX
|
|
circulates under many different names. Although I will try to
|
|
keep all of these names current in the DD, the best way to check
|
|
for piracy in a file is to run that file yourself. Check for
|
|
(C)opyright notices of commercial manufactures, similarities in
|
|
the cosmetics and operations of commercial programs, and of course
|
|
whether the name or filesize is in this list.
|
|
|
|
Finally I want to thank all BBS SysOps and users that sent
|
|
updates, additions, and/or corrections to DIRTYDOZ.007. It's
|
|
great to see so much support! In this issue more people than ever
|
|
called in with updates. Everyone else who reads this list, along
|
|
with myself, really appreciates the effort!
|
|
|
|
|
|
|
|
DEFINITIONS:
|
|
|
|
|
|
*VIRUS* (V) BEWARE!! Especially prevalent in universities
|
|
and corporate computers, computer virii can wreak
|
|
havoc. They, like biological virii, attack
|
|
slowly, originating on one computer and
|
|
proliferating with time. Virii infect a
|
|
portion of a computer, usually the operating
|
|
system. Most virii modify floppy disks
|
|
(that may or may not be transported to other
|
|
computers), adding diabolical code that
|
|
instruct other computers to replicate the virii
|
|
for still more computers. In other words, the
|
|
floppies become virii themselves; they can be
|
|
passed around to other people to create more
|
|
virii.
|
|
|
|
Virii can be programmed to sit dormant for
|
|
months before acting, just like some biological
|
|
virii (AIDS comes to mind). Users can
|
|
unwittingly replicate a virus many times. If
|
|
people know how to spot virii, however, they
|
|
can usually prevent damage.
|
|
|
|
Virii generally add their code to COMMAND.COM,
|
|
IBMBIO.COM, or IBMSYS.COM. These three files,
|
|
which DOS places on every system disk, are the
|
|
only files copied to other disks and run on
|
|
other machines often enough to do any damage.
|
|
If you see the filesizes on these files change,
|
|
beware a virus!
|
|
|
|
Your computer provides a small line of defense
|
|
against Virii already! IBMBIO.COM and
|
|
IBMSYS.COM are READ-ONLY files; that is, only a
|
|
very sophisticated virus can add code to them.
|
|
COMMAND.COM, however, is NOT read only.
|
|
Therefore, I advise that EVERYONE make their
|
|
COMMAND.COM read-only using a utility program
|
|
such as FILEATTR.COM (available on my board in
|
|
ARC format), or PC-Tools. This will give
|
|
COMMAND.COM some basic protection, and since
|
|
few people ever write to their command
|
|
processor, this process should not cause any
|
|
undue hassles. Keep in mind, though, that if
|
|
you ever want to upgrade your version of DOS
|
|
you will have to change COMMAND.COM back to a
|
|
regular (not read-only) file.
|
|
|
|
For further information on Virii, everyone may
|
|
download VIRUS.ARC from my board.
|
|
|
|
|
|
|
|
*TROJAN* (T) These programs PURPOSEFULLY damage a user's
|
|
system upon their invokation. They almost
|
|
always will shoot to disable hard disks,
|
|
although they can destroy other equipment too.
|
|
It is IMPERATIVE that you let me know about any
|
|
new examples of these that you find.
|
|
|
|
There are more than one way a TROJAN can
|
|
disable your hard disk. For a comprehensive
|
|
list of examples, please skip to "What to do if
|
|
you run a trojan horse" later in this document.
|
|
|
|
HACKED (¤) An unlawfully modified copy of an otherwise
|
|
legitimate public domain or user-supported
|
|
program. It is illegal to distribute a
|
|
modified copy of someone else's work without
|
|
their permission! All modified programs must
|
|
contain this permission in the program's display
|
|
or documentation.
|
|
|
|
*CAUTION* (C) Programs labeled in this manner may or may not
|
|
be trojans; the question is unresolved. Use
|
|
caution when running these programs!
|
|
|
|
PIRATED (P) This is an illegal copy of a commercial,
|
|
copyrighted program. Examples: a cracked
|
|
(de-protected) game, a compiler, editor or
|
|
other utility, or a Beta test copy of a program
|
|
under development. In the latter case, the
|
|
program in question may never make it to market
|
|
due to the piracy! In the case of games,
|
|
there's a tendency for the pirate to patch a
|
|
clumsy "PUBLIC DOMAIN" notice over top of the
|
|
original copyright. ZAXXON.COM is a prime
|
|
example.
|
|
|
|
MISC (M) This is miscellaneous illegal software and/or
|
|
text. The best definition, aside from that,
|
|
that I can think of is that it's NOT pirated
|
|
software.
|
|
|
|
|
|
NOTE: If I do not supply a file extension, that means that the
|
|
file circulates under many different extensions. For instance,
|
|
users commonly upload with extensions of either: .EXE, .COM,
|
|
.EQE, .CQM, .LBR, .LQR, and .ARC.
|
|
|
|
|
|
------------------------------------------------------------------
|
|
| VIRII |
|
|
------------------------------------------------------------------
|
|
|
|
|
|
Name Size Category Notes
|
|
------------- ------ - -----------------------------------------
|
|
|
|
CHRISTMAS.EXEC ??? V This is the famous Bitnet virus. Around
|
|
Christmas time, this program sent mail to
|
|
every bitnet user with a defined "nickname"
|
|
(Bitnet users use short nicknames to
|
|
avoid typing long user ID's) with a
|
|
picture of a christmas tree. The mail
|
|
eventually reached so many people that it
|
|
overloaded the system, creating a lot of
|
|
yuletide headaches.
|
|
|
|
PC Users do not need to worry about the
|
|
Bitnet virus. The program is written in
|
|
REXX, a mainframe only language, and it
|
|
can only run on mainframes that use
|
|
Bitnet's nickname technique. This entry,
|
|
in fact, is here primarily to help clear
|
|
up the confusion prevalent when talking
|
|
about this virus.
|
|
|
|
*.EXE, *.COM ANY V Any of your executable files may
|
|
contain a virus in it. Don't Panic,
|
|
though; this virus is detectable! If you
|
|
have an infected file, it will increase
|
|
the size of all other .EXE files run
|
|
thereafter by 1808 bytes and all .COM
|
|
files by 1813 bytes upon invocation.
|
|
|
|
Now you know how to recognize this
|
|
virus. Be sure to look out for it,
|
|
because the symptoms it creates are very
|
|
nasty. The virus increases the size
|
|
of .EXE files repeatedly - not just once.
|
|
While this is a boon in recognizing the
|
|
virus, it also means that eventually all
|
|
affected .EXE files will become to large
|
|
to fit in memory. The virus also slows
|
|
down computers by as much as 500% after
|
|
it has spread. Watch for this symptom!
|
|
Perhaps most deadly, on any Friday the
|
|
13th, this virus will erase AT LEAST all
|
|
.EXE and .COM files that you run, and AT
|
|
WORST your whole disk. The next Friday
|
|
the 13th is May 13, 1988.
|
|
|
|
COMMAND.COM ????? V This is a traditional Virus. Originating
|
|
in colleges and universities accross the
|
|
nation, this virus will embed itself in
|
|
COMMAND.COM. Once there it will copy
|
|
itself onto FOUR floppies before
|
|
scrambling your FAT and initiating a
|
|
format. Beware! In one known instance,
|
|
the virus does NOT change the filesize
|
|
of COMMAND.COM, but it does change
|
|
the date.
|
|
|
|
QMDM31B.ARC ?????? V The latest official release of Qmodem,
|
|
as of this writing, is 3.1a. This
|
|
version, which is less than 1 KB bigger
|
|
than the Archive for 3.1a, will add 17
|
|
bytes to your IBMBIO.COM file. Beware;
|
|
while I don't know how this virus works,
|
|
I do know that there's NEVER any reason
|
|
to add 17 bytes to IBMBIO.COM.
|
|
Note: IBMBIO.COM is a READONLY file.
|
|
In other words, here is the first trojan
|
|
that can write past a "write protect;"
|
|
this virus acts when it theoretically
|
|
shouldn't be able to.
|
|
|
|
------------------------------------------------------------------
|
|
| TROJAN HORSE PROGRAMS: |
|
|
------------------------------------------------------------------
|
|
|
|
|
|
Name Size Category Notes
|
|
------------- ------ - -----------------------------------------
|
|
|
|
123JOKE T This so-called utility for Lotus 123
|
|
rewrites [hard] disk directories.
|
|
|
|
ANTI-PCB T The story behind this trojan horse is
|
|
sickening. Apparently one RBBS-PC sysop
|
|
and one PC-BOARD sysop started feuding
|
|
about which BBS system is better, and in
|
|
the end the PC-BOARD sysop wrote a trojan
|
|
and uploaded it to the rbbs SysOp under
|
|
ANTI-PCB.COM. Of course the RBBS-PC
|
|
SysOp ran it, and that led to quite a few
|
|
accusations and a big mess in general.
|
|
Let's grow up! Every SysOp has the right
|
|
to run the type of BBS that they please,
|
|
and the fact that a SysOp actually wrote
|
|
a trojan intended for another simply
|
|
blows my mind.
|
|
|
|
ALTCTRL.ARC T This program reputedly trashes boot
|
|
records. Other than that, I know nothing
|
|
about it.
|
|
|
|
ARC513.EXE T This hacked version of SEA's ARC.EXE
|
|
appears normal. However, it writes
|
|
over track 0 of your [hard] disk upon
|
|
usage, destroying the disk's boot sector.
|
|
|
|
ARC514.COM T This is completely similar to arc
|
|
version 5.13 in that it will overwrite
|
|
track 0 (boot sector) of your hard disk.
|
|
Also, I have yet to see an .EXE version
|
|
of this program..
|
|
|
|
BACKALLY.COM 64512 T This sophisticated trojan will axe your
|
|
FAT table after a couple of months of
|
|
usage. Beware the delayed trojan!
|
|
Backally MAY only work on floppy disks,
|
|
but that sounds unlikely. Debug has
|
|
shown that BACKALLY formats a track at
|
|
one point as well as reading in the
|
|
amount of freespace on your disk. It may
|
|
only wipe out full disks, like NOTROJ.
|
|
Please, be wary! An included .BAT file
|
|
comes with a request for donations to
|
|
"SomeWare" located in Frederickburg, VA.
|
|
Look out for other products from
|
|
SomeWare!
|
|
|
|
BACKTALK T This once beneficial utility will
|
|
write/destroy sectors on your [hard] disk
|
|
drive. Use this with caution if you
|
|
acquire it, because it's more than likely
|
|
that you got a bad copy.
|
|
|
|
BXD.ARC 20480 T This disk killer warns users that "your
|
|
disk will be trashed in 5 seconds" on
|
|
sector 17 on the included BXD.COM file.
|
|
Watch out for this FAT killer!
|
|
|
|
CDIR.COM T This program supposedly gives you a
|
|
color directory of files on disk, but it
|
|
in fact scrambles your disks FAT
|
|
table.
|
|
|
|
CHUNKER.EXE TC A part of QEDIT v. 2.02, this program
|
|
writes five apparently harmless files to
|
|
disk. Chunker, which is supposed to
|
|
split large text files into more
|
|
manageable, smaller ones, may also
|
|
scramble FAT's.
|
|
|
|
COMPRESS.ARC T This trojan, dated April 1, 1987,
|
|
destroys FAT tables. COMPRESS is
|
|
executed from a file named RUN-ME.BAT and
|
|
is advertised as a 'Shareware 'ARC' from
|
|
Borland!'
|
|
|
|
DANCERS.BAS T This trojan shows some animated dancers
|
|
in color, and then proceeds to wipe out
|
|
your [hard] disk's FAT table. There is
|
|
another perfectly good copy of
|
|
DANCERS.BAS on BBS's around the country;
|
|
apparently the author altered a
|
|
legitimate program to do his dirty work.
|
|
|
|
DEFENDER.ARC T This trojan both writes to ROM bios and
|
|
formats [hard] disks. The Duplicators
|
|
claim credit for this trojan; be ware of
|
|
other products by them. Also, do not
|
|
confuse this trojan with DEFENDER by
|
|
Atari. The latter is a pirated program.
|
|
|
|
DISCACHE.EXE TC This program uses direct BIOS routines
|
|
to write to disk. Apparently, those BIOS
|
|
routines will scramble your FAT table.
|
|
Please see DISCACHE.WNG, a file that I'm
|
|
looking for myself, for more information.
|
|
There is at least one legitimate
|
|
DISCACHE.EXE file circulating, so
|
|
not all DISCACHE programs are trojan.
|
|
|
|
DISKSCAN.EXE T This was a PC Magazine program to scan a
|
|
[hard] disk for bad sectors, but then a
|
|
joker edited it to WRITE bad sectors.
|
|
Also look for this under other names such
|
|
as SCANBAD.EXE and BADDISK.EXE...
|
|
|
|
DMASTER T This is yet another FAT scrambler..
|
|
|
|
DOSKNOWS.EXE 6144 TC I'm still tracking this one down --
|
|
apparently someone wrote a FAT killer and
|
|
renamed it DOSKNOWS.EXE, so it would be
|
|
confused with the real, harmless DOSKNOWS
|
|
system-status utility. I'm pretty sure
|
|
that sure is that the REAL DOSKNOWS.EXE
|
|
is 5376 bytes long. If you see something
|
|
called DOSKNOWS that isn't close to that
|
|
size, sound the alarm. More info on this
|
|
one is welcomed -- a bagged specimen
|
|
especially. The malicious DOSKNOWS
|
|
contains the string: "Ouch! Dos refused
|
|
to tell me! Sob, sob, sob." Be careful;
|
|
there may be a legitimate 6144 byte
|
|
DOSKNOWS floating around too.
|
|
|
|
DPROTECT T Apparently someone tampered with the
|
|
original, legitimate version of DPROTECT
|
|
and turned it into a FAT table eater.
|
|
|
|
DROID.EXE 54272 T This trojan appears under the guise of a
|
|
game. You are supposably an architech
|
|
that controls futuristic droids in search
|
|
of relics. In fact, the program copies
|
|
C:\PCBOARD\PCBOARD.DAT to
|
|
C:\PCBOARD\HELP\HLPX if PC-Board SysOps
|
|
run it from C:\PCBOARD
|
|
|
|
EGABTR T BEWARE! Description says something like
|
|
"improve your EGA display," but when run
|
|
it deletes everything in sight and prints
|
|
"Arf! Arf! Got you!"
|
|
|
|
ELEVATOR.ARC T This poorly written trojan suggests in
|
|
the documentation that you run it on a
|
|
floppy. If you do not run it on a
|
|
floppy, Elevator chastises you for not
|
|
reading the documentation. Regardless of
|
|
what disk you run it on, Elevator will
|
|
erase your files. It MAY format disks
|
|
too; be careful. One more interesting
|
|
point to note: my name is plastered all
|
|
over this program; the writers attempt to
|
|
lay the blame for this trojan on me.
|
|
|
|
EMMCACHE ???? T This program is not exactly a trojan,
|
|
V. 1.0 but it may havethe capability of
|
|
destroying hard disks by:
|
|
A) Scrambling every file modified after
|
|
running the program,
|
|
B) Destroying boot sectors.
|
|
This program has damaged at least two
|
|
hard disks, yet there is a base of
|
|
happily registered users. Therefore, I
|
|
advise extreme caution if you decide to
|
|
use this program.
|
|
|
|
FILER.EXE T One SysOp complained a while ago that
|
|
this program wiped out his 20 Megabyte
|
|
HD. I'm not so sure that he was correct
|
|
and/or telling the truth any more. I
|
|
have personally tested an excellent file
|
|
manager also named FILER.EXE, and it
|
|
worked perfectly. Also, many other
|
|
SysOp's have written to tell me that they
|
|
have like me used a FILER.EXE with no
|
|
problems. If you get a program named
|
|
FILER.EXE, it is probably allright, but
|
|
better to test it first using some
|
|
security measures.
|
|
|
|
FINANCE4.ARC ?????? TC This program is not a verified trojan,
|
|
but there is a file going around BBS's
|
|
warning that it may be trojan. In any
|
|
case, execute extreme care with it.
|
|
|
|
FUTURE.BAS T This "program" starts out with a very
|
|
nice color picture (of what I don't know)
|
|
and then proceeds to tell you that you
|
|
should be using your computer for better
|
|
things than games and graphics. After
|
|
making that point it trashes your all of
|
|
your disk drives, starting with disk A:.
|
|
Not only does Future scramble FATs, but
|
|
it also erases files. As far as I know,
|
|
however, it erases only one sub-directory
|
|
tree level deep, thus hard disk users
|
|
should only be seriously affected if they
|
|
are in the "root" directory. More
|
|
information about this is especially
|
|
welcome.
|
|
|
|
MAP T This is another trojan horse written by
|
|
the infamous Dorn W. Stickle. I believe
|
|
that there are legitimate MAP.EXEs
|
|
floating around.
|
|
|
|
NOTROJ.COM T This "program" is the most sophisticated
|
|
trojan horse that I've seen to date. All
|
|
outward appearances indicate that the
|
|
program is a useful utility used to FIGHT
|
|
other trojan horses. Actually, it is a
|
|
time bomb that erases any hard disk FAT
|
|
table that IT can find, and at the same
|
|
time it warns: "another program is
|
|
attempting a format, can't abort!" After
|
|
erasing the FAT(s), NOTROJ then proceeds
|
|
to start a low level format. One extra
|
|
thing to note: NOTROJ only damages FULL
|
|
hard drives; if a hard disk is under 50%
|
|
filled, this program won't touch it! If
|
|
you are interested in reading a thorough
|
|
report on NOTROJ.COM, James H. Coombes
|
|
has written an excellent text file on the
|
|
matter named NOTROJ.TXT. If you have
|
|
trouble finding it, you can get it from
|
|
my board.
|
|
|
|
TIRED T Another scramble the FAT trojan by Dorn
|
|
W. Stickle.
|
|
|
|
TSRMAP T This program does what it's supposed to
|
|
do: give a map outlining the location (in
|
|
RAM) of all TSR programs, but it also
|
|
erases the boot sector of drive "C:".
|
|
|
|
PACKDIR T This utility is supposed to "pack" (sort
|
|
and optimize) the files on a [hard] disk,
|
|
but apparently it scrambles FAT tables.
|
|
|
|
PCLOCK TC This program reputedly destroys FAT
|
|
tables! Be careful! Also, please bear
|
|
in mind that there are more than one
|
|
PCLOCK programs in circulation, so please
|
|
don't confuse the trojan program with a
|
|
legitimate one. Simply excercise EXTREME
|
|
caution when running a NEW PCLOCK
|
|
program.
|
|
|
|
PCW271xx.ARC T A modified version of the popular
|
|
PC-WRITE word processor (v. 2.71) has now
|
|
scrambled at least 10 FAT tables that I
|
|
know of. If you want to download
|
|
version 2.71 of PC-WRITE be very careful!
|
|
The bogus version can be identified by
|
|
its size; it uses 98,274 bytes wheras the
|
|
good version uses 98,644. For reference,
|
|
version 2.7 of PC-WRITE occupies 98,242
|
|
bytes.
|
|
|
|
PKX35B35.EXE T As of this writing, Phil Katz (author of
|
|
PKXARC) has verified that version 35A35
|
|
is the latest version of his ARChive
|
|
extractor. This phony PKXARC scrambles
|
|
FAT tables.
|
|
|
|
QUIKRBBS.COM T This Trojan horse claims that it can
|
|
load RBBS-PC's message file into memory
|
|
200% faster than normal. What it really
|
|
does is copy RBBS-PC.DEF into an ASCII
|
|
file named HISCORES.DAT...
|
|
|
|
QUIKREF T Little is known about this trojan, other
|
|
than it scrambles FATS
|
|
|
|
RCKVIDEO T This is another trojan that does what
|
|
it's supposed to do, then wipes out hard
|
|
disks. After showing some simple
|
|
animation of a rock star ("Madonna," I
|
|
think), the program erases every file it
|
|
can lay it's hands on. After about a
|
|
minute of this, it will create 3 ascii
|
|
files that say "You are stupid to
|
|
download a video about rock stars," or
|
|
something of the like.
|
|
|
|
SCRNSAVE.COM TC I know nothing about this program, but a
|
|
user of mine reports that it erases HD's.
|
|
|
|
SECRET.BAS T BEWARE!! This may be posted with a note
|
|
saying it doesn't seem to work, and would
|
|
someone please try it. If you do try it,
|
|
however, it will format your disks.
|
|
|
|
SEX-SNOW.ARC T This trojan deletes all of the files
|
|
in your directory and creates a gloating
|
|
message using those filenames. Ugly.
|
|
|
|
SIDEWAYS.COM T Be careful with this trojan; there is a
|
|
perfectly legitimate version of
|
|
SIDEWAYS.EXE circulating. Both the trojan
|
|
and the good SIDEWAYS advertise that they
|
|
can print sideways, but SIDEWAYS.COM will
|
|
trash a [hard] disk's boot sector
|
|
instead. The legitimate .EXE file is
|
|
about 30 KB large.
|
|
|
|
STAR.EXE T Beware RBBS-PC SysOps! This file puts
|
|
some stars on the screen while copying
|
|
RBBS-PC.DEF to another name that can be
|
|
downloaded later!
|
|
|
|
STRIPES.EXE T Similar to STAR.EXE, this one draws an
|
|
American flag (nice touch), while it's
|
|
busy copying your RBBS-PC.DEF to another
|
|
file (STRIPES.BQS) so Bozo can log in
|
|
later, download STRIPES.BQS, and steal
|
|
all your passwords. Nice, huh!
|
|
|
|
SUG.ARC T Words can not express my feelings about
|
|
this trojan. SUG.ARC advertises that it
|
|
can break SOFTGUARD copy protection, but
|
|
upon invocation, it will scramble the
|
|
FAT's on drive A, B, C, and onwards to
|
|
your higest drive. While this is
|
|
certainly a nasty trojan, it is
|
|
particularly repulsive because Softguard
|
|
Corp, the creators of Softguard
|
|
copy-protection, wrote it - perhaps in
|
|
response to declining business. They
|
|
claim that anyone who runs SUG is
|
|
breaking an original license agreement;
|
|
therefore they may legally destroy data.
|
|
I don't credit this, and neither does an
|
|
attorney I know, so I eagerly anticipate
|
|
Softguard's day in court.
|
|
|
|
TOPDOS T This is a simple high level [hard] disk
|
|
formatter. Do not confuse this with the
|
|
pirated TOPDOS.COM.
|
|
|
|
VDIR.COM T This is a disk killer that Jerry
|
|
Pournelle wrote about in BYTE Magazine.
|
|
I have never seen it, but two users of
|
|
mine have.
|
|
|
|
VISIWORD.ARC TC A user of mine called this trojan in
|
|
complaining that it destroyed his hard
|
|
disk. Other than that, I know nothing
|
|
about this program.
|
|
|
|
WARDIAL1.ARC TC This Wardialer may scramble FAT tables
|
|
|
|
|
|
------------------------------------------------------------------
|
|
| HACKED PROGRAMS: |
|
|
------------------------------------------------------------------
|
|
| |
|
|
| '*' = not verified by program's author |
|
|
| |
|
|
------------------------------------------------------------------
|
|
|
|
|
|
|
|
ARC.COM H Someone keeps running SPACEMAKER or a
|
|
similar EXE squeezer on SEA, Inc.'s ARC
|
|
archive program, then uploading the
|
|
resulting COM file to BBS's without the
|
|
author's permission. SEA will NOT
|
|
support the COM version, for they
|
|
definately do not allow modifying ARC.EXE
|
|
in their license agreement.
|
|
|
|
AUTOMAXX.ARC C This DOS menu-making program comes with
|
|
documentation that Marshall Magee, author
|
|
of the popular AUTOMENU program, contends
|
|
is plagiarized. Marshall believes that
|
|
the AUTOMAXX documentation uses exact
|
|
phrases from his documentation, and if
|
|
this is the case, AUTOMAXX is clearly
|
|
illegal. However, as I understand it,
|
|
the courts are currently deliberating on
|
|
the case, so AUTOMAXX is not currently
|
|
illegal. of today. For more information,
|
|
please contact Marshall Magee at (404)
|
|
446-6611.
|
|
|
|
DOG101A.COM * C This may be hacked; keep an eye out
|
|
for it as well as DOG102A.COM.
|
|
|
|
DOG102A.COM * H Apparently this is a renamed early
|
|
version of DP102A.ARC, a disk optimizer.
|
|
One person has reports that it trashes
|
|
hard disks that use DOS 3.1 (2KB
|
|
clusters).
|
|
|
|
LIST60 H Vern Buerg's LIST 5.1, patched to read
|
|
6.0. Mr. Buerg has released a legitimate
|
|
version 6.0 of LIST. Every legit.
|
|
version will have a letter in the
|
|
filename (e.g. LIST60H.ARC)
|
|
|
|
LIST799 H Vern Buerg's LIST 5.1, patched to read
|
|
7.99.
|
|
|
|
QMDM110.ARC H This is version 1.09 of Qmodem patched
|
|
to read 1.10. There have been rumors of
|
|
a worm in 1.10, but I have seen no
|
|
evidence of it. Other versions are OK.
|
|
|
|
|
|
------------------------------------------------------------------
|
|
| PIRATED PROGRAMS: |
|
|
| |
|
|
| |
|
|
| TYPES: |
|
|
| Game (G) -- Recreational Software, usually high Quality |
|
|
| Util (U) -- a disk, screen, or general utility |
|
|
| Misc (M) -- Miscellaneous (not a game or utility) |
|
|
------------------------------------------------------------------
|
|
|
|
|
|
Note: While close to 98%-99% of BBS's that I've seen do NOT
|
|
distribute pirated files, the small minority that do slander the
|
|
reputations of honest SysOp's nationwide. Unfortunately, 1%-2% of
|
|
thousands of BBS's is a sizable number. Over the last couple of
|
|
years this 1%-2% has distributed so many files that even the most
|
|
conscientious SysOp can hardly hope to recognize all commercial
|
|
software.
|
|
|
|
You may ask: "How can we fight piracy, then?"
|
|
|
|
SysOp's and users alike must search ALL programs for signals
|
|
that can reveal a program as commercial. Look for Copyright
|
|
signs. Suspect good games with sparse if any documentation. If
|
|
you notice that a program is pirated, calmly inform your local
|
|
SysOp's of the menace. In order to beat piracy, we must
|
|
communicate!
|
|
|
|
Name Size Category Notes
|
|
------------- ------ -- -----------------------------------------
|
|
|
|
1DIR.COM PU "The ONE Dir": DOS shell.
|
|
21C.EXE PG Blackjack, copyright by IBM
|
|
3DCHESS PG Psion's 3D Chess program
|
|
400KDISK.ARC 8192 PU Qdrive by Tall Tree Systems: allows
|
|
floppy disks to be formatted to 400 KB.
|
|
ACUPAINT.ARC 148221 PM PC Paint
|
|
AFOX.ARC PG Artic Fox by Electronic Arts
|
|
ALLEYCAT.COM PU "Alley Cat" - CGA
|
|
ALTEREGO.ARC 45???? PG Alter Ego game from Activision
|
|
ARCHON.COM PG Electronic Art's Archon.
|
|
ARTOFWAR PG Ancient Art of War by Broderbund
|
|
AUTODEX PU AUTODEX, file manager
|
|
AXX.EXE PU Also AUTODEX
|
|
B1-BOMB PG Avalon Hill's B1 Bomber
|
|
BATTLE PG Battle Zone
|
|
BBCHESS PG Blues Box Chess
|
|
BC-QUEST PG Bc's Quest for Tires
|
|
BIGMAC.ARC PU Borland's Superkey
|
|
BORDERZO.ARC 205824 PG Infocom's Borderzone
|
|
BORROWED.ARC PG Borrowed Time
|
|
BRUCELEE PG Bruce Lee
|
|
BUCK PG Buck Rogers on Planet Zoom
|
|
BURGER PG Burgertime
|
|
BUSHIDO PG Karate Game by a manufacturer in Canada.
|
|
BUZZBAIT PG Buzzard Bait
|
|
CALL2ARM PG Call to Arms
|
|
CDRAGON1.ARC 45056 PG Sea Dragon
|
|
CENTIPED PG Be careful with this one. At least two
|
|
other legitimate, PD copies of
|
|
Centipede are in circulation. The
|
|
pirated one is supposedly PUBLIC DOMAIN
|
|
BY ATARI. Yeah, Right.
|
|
CHIWRITR.ARC PU The last Shareware version of this
|
|
scientific word processor is version
|
|
1.32. Any more recent version, such as
|
|
version 2.0, is commercial; apparently
|
|
the author(s) tired of never receiving
|
|
donations for what sounds like a good
|
|
program.
|
|
CMASTER.ARC PG Chess Master 2000 by Electronic Arts
|
|
COMMANDR.ARC PG Norton Commander
|
|
COSMIC PG Cosmic Crusaders
|
|
COPYRITE PU Quaid Software's COPYWRITE
|
|
COPYWRIT PU Quaid Software's COPYWRITE again
|
|
COSMIC PG Cosmic Crusaders again
|
|
CROSFIRE.COM PG Crossfire
|
|
CRUSH-CC.ARC PG Crush, Crumble & Chomp
|
|
DAMBUST.ARC PG Dambusters by Accolade cracked
|
|
DEB88.EXE PM DeSmet 'C' debugger
|
|
DECATH PG Microsoft's Decathalon
|
|
DEFENDER PG Defender, by Atari
|
|
DIGDUG.COM PG Dig Dug, also by Atari
|
|
DIGDUG.COM PG Dig Dug again
|
|
DISKEX PU Quaid's Disk Explorer
|
|
DOSHELP.EXE PU This is really Central Point
|
|
Software's PC-tools. One special note:
|
|
poorly written documentation usually
|
|
accompanies this file. In the
|
|
documentation ERIC HSU asks for a
|
|
monetary contribution to his bbs. Well,
|
|
It seems that this was a poor attempt to
|
|
damage ERIC HSU's reputation; Eric is a
|
|
legitimate SysOp in the Houston area.
|
|
DOSMENU.ARC 208240 PU Intech's Dosmenu - Opening screen says
|
|
"PC DOS MENU SYSTEM 5.0." - (C) is on
|
|
the bottom of the screen.
|
|
DOSSHELL PU Autodex again
|
|
DRL PG Avalon Hill's "Dnieper River Line."
|
|
DIPLOMCY PG Avalon Hill's "Computer Diplomacy" game.
|
|
EGADIAG PU Quadram EGA (Quad EGA+) diagnostics.
|
|
EINSTIME PU IBM internal utility
|
|
EMPIRE.ARC 75611 PG Insterstel's Empire
|
|
EXPLORER.COM PU Quaid Disk Explorer again
|
|
EVOLUTIO PG Evolution
|
|
F15 PG F-15 Strike Eagle
|
|
FALCON.ARC PG Falcon by Spectrum Holobyte - flight sim
|
|
FIGHTER.ARC PG Sublogic's JET
|
|
FILEEASE PU A File manager
|
|
FILEMGR PU Filemanager by Lotus Devel. Corp.
|
|
FILEMAN.COM 1???? PU Also Filemanager
|
|
FINDIT PU IBM internal 'locate a file' utility
|
|
FSDEBUG PU IBM's Full Screen Debug program..
|
|
GOLDCUP PG Gold Cup championship soccer
|
|
GOLF21.ARC PG Golf's Best version 2.1
|
|
GREMLINS.COM PG Gremlins
|
|
HARDHAT.COM PG Hard Hat Mack
|
|
HIGHORBT PG High Orbit (like Star Wars)
|
|
HOOP.COM PG One-on-1 by Electronic Arts
|
|
ID PU Persyst Ram disk software
|
|
IBM21 PG 21c again
|
|
IKARI.ARC 210944 PG Ikari Warriors - CGA/EGA, joystick reqd.
|
|
IPLTIME.COM PU IBM Internal Clock utility
|
|
JBIRD PG Jbirds -- Q-bert Game
|
|
JEOPARDY 195??? PG Jeopardy, the game show.
|
|
JET PG Jet
|
|
JETDRIVE.ARC PU Jet Drive -- copies files quickly
|
|
JOUST PG Joust. There is a 6K, PD version
|
|
KEYWORKS.ARC PU Keyworks macro program, usu. version 2.0
|
|
KOBAYASH.ARC PG Star Trek -- The Kobayashi Alternative
|
|
KONG PG Donkey Kong
|
|
LIGHTNIN PU Can be either the cache or spell checker
|
|
MACE+ PU Paul Mace's MACE+ utilities
|
|
MACROS PU Again Superkey - sometimes Prokey
|
|
MEDMAG.COM PU Quaid Software's Media Magician
|
|
MINER49R.ARC PG Miner '49er
|
|
MISSLEC PG Missle command
|
|
MONTYS.COM PG Montezuma's Revenge
|
|
MOONBUGS PG Moon Bugs
|
|
MS PU IBM utility.
|
|
MTS PU IBM Multitasker like Double-Dos
|
|
MULE PG M.U.L.E -- players is on alien planet
|
|
MULTASK PU MTS again
|
|
MURDRBY# PG Murder by Numbers by Electroni Arts
|
|
MUSICCON PM Music Construction Set, also by EA
|
|
NFL.ARC PG Xor's NFL challenge.
|
|
NGHTSTLK PG Night Stalker
|
|
NICE PM NicePrint - printer controller
|
|
NODISK-A.COM PU Central Point software's Nokey
|
|
NORTON.COM PU Peter Norton's Utilities
|
|
ANORTON.ARC PU Peter Norton's Advanced Utilities
|
|
NOVATRON PU Tron light cycles
|
|
ONE-ON-1 PG One-on-1 basketball game, again
|
|
PATHMIND PU Pathminder, Dos Shell
|
|
PC-POOL PG Pool
|
|
PC-TOOLS PU Central Point Software's PC-tools
|
|
PCBOSS PU DOS shell
|
|
PCED PU Pro CED, DOS command line editor
|
|
EII PU IBM Personal Editor II
|
|
PANGO.ARC 17957 PG Pango, sometimes cracked to read cracked
|
|
by Eric Newhouse
|
|
PINCONST PG Pinball Construction Set by EA
|
|
POOL.ARC PG PC-POOL again
|
|
POPALARM.COM PU Part of POP DOS
|
|
POPDOS.ARC PU TSR DOS utilities
|
|
PRIME PU Columbia Data Co. hard disk utility.
|
|
PROKEY PU Prokey macros program
|
|
PROMPRPH PG Star Trek -- The Promethian Prophesy
|
|
PSHIFT PU Memory Shift
|
|
PSRD.ARC PU IBM utility (redirects PrtSc)
|
|
QDOS PU Quick DOS
|
|
QUCKDOS PU Quick DOS
|
|
QIX PG Qix
|
|
RACTER PG Racter
|
|
RASTER-B PG Raster Blaster
|
|
RE.ARC PG Romantic Encounters at the Dome
|
|
RIGHTW PU Right Writer (writing style checker)
|
|
ROBOTRON PG Robotron, hacked to read PUBLIC DOMAIN
|
|
BY ATARI. Do pirates have any
|
|
imagination?
|
|
ROGUE.EXE PG Game very similar to the PD: HACK.EXE
|
|
ROMANTIC PG Romantic Encounters at the Dome, again
|
|
SEADRAG.ARC 45056 PG Also Sea Dragon
|
|
SEE PM DeSmet editor
|
|
SFX PU Autodex (again!)
|
|
SKYRUNER PG Sky Runner, $14.95 game.
|
|
SIMCGA40 15360 PU According to a user of mine, version 4.0
|
|
of the CGA emulator for Herc cards is no
|
|
longer a shareware program
|
|
SM.COM PU Realia's Spacemaker utility. .EXE->.COM
|
|
SMAP PU IBM Internal utility, with the copyright
|
|
notice and real author's name replaced by
|
|
"Dorn W. Stickle".
|
|
SNIPER PG Sniper -- arcade action type game.
|
|
SOLOFLT.ARC PG Solo Flight (by SSI?) cracked
|
|
SPACNVDR.ARC 9513 PG Space Invaders
|
|
SPYHUNT PG Bally's Spy Hunter
|
|
STARFLIT.ARC 30???? PG Electronic Art's Star Flight
|
|
STARGATE.EXE 57??? PG Hacked to say "PUBLIC DOMAIN BY ATARI,"
|
|
but don't you believe it! Be careful not
|
|
to confuse this arcade game with the
|
|
public domain STARGATE MERCHANT game,
|
|
which is a little 12 KB BASIC program by
|
|
G. E. Wolfworth.
|
|
STRIPKR PG Strip Poker by Artworx
|
|
SUBCMDR.ARC PG Gato cracked: SUBCMDR.EXE & overlays
|
|
SUPERCAD PM Easy CAD
|
|
SUPERCAD.LQR 242660 PM Easy CAD again.
|
|
SUPERKEY PM Superkey again
|
|
TEMPOFAP PG Temple of Apshai
|
|
THEQUEST.BAS/EXE PG The Quest
|
|
TIRES.EXE PG Bc's Quest for Tires again
|
|
TREASURE PG Pirate's Treasure
|
|
TROJAN.ARC 304128 PG Trojan - CGA/EGA, (C) 1987, like D&D.
|
|
TWIN.ARC 2784 PU Central Point's Copy II PC
|
|
TWINCOPY.ARC 22784 PU Also Copy II PC
|
|
ULTIII 111616 PG Origin's Ultima 3
|
|
ULTIMA2.ARC 84992 PG Origin's Ultima 2
|
|
UTILITY PU Norton's Utilities Arced and with the
|
|
file names changed. When run, however,
|
|
the programs display the copyright notice
|
|
of Peter Norton. Many other pirated
|
|
utilities could also go under the name
|
|
UTILITY.
|
|
VOYAGERI PG Avalon-Hill Game
|
|
VS PU Also INTECH'S DOSMENU
|
|
WCKARATE PG World Championship Karate by Epyx
|
|
WG-BBALL PG World's Greatest Baseball Game by SSI
|
|
WGAMES PG World Games by Epyx
|
|
WOF.ARC PG Wheel of Fortune
|
|
WORSTR PU Word Star
|
|
XDIR PU Pre-release version of DOS FILE TRACKER
|
|
XTREE PU DOS shell
|
|
XTREE+ PU Xtree Plus
|
|
ZAXXON PG Hacked to say "PUBLIC DOMAIN BY SEGA."
|
|
(sound familiar?)
|
|
|
|
|
|
------------------------------------------------------------------
|
|
| MISCELLANEOUS ILLEGAL FILES: |
|
|
| |
|
|
| TYPES: |
|
|
| Game (G) -- Recreational software |
|
|
| Patch (P) -- Modification to another program usually |
|
|
| performed through debug. |
|
|
| Text (T) -- Text / Documentation File |
|
|
| Util (U) -- Utility of some sort |
|
|
------------------------------------------------------------------
|
|
|
|
Name Size Category Notes
|
|
------------- ------ -- ----------------------------------------
|
|
|
|
COPYWRIT 2??? MP Although the real COPYWRITE is going
|
|
around Bulletin Boards like fire, there
|
|
is another illegal file under the same
|
|
name. The former takes around 40 KB
|
|
ARC-ed, whereas this takes about 2 KB.
|
|
What I'm referring to is an archive of
|
|
1-3 files that explains how to remove
|
|
the serial numbers from copywrite. Now
|
|
it's allright to "unprotect" a program
|
|
for backup purposes, but removing serial
|
|
numbers can only lead to piracy.
|
|
LOCKPICK MT This is a text file, usually with a
|
|
.TXT extension, that casually explains
|
|
how to pick locks. This is not
|
|
illegal, but it's definitely in
|
|
poor taste. It could be used as
|
|
evidence against a burglar, though.
|
|
MONEY.ARC MT This text file claims that with minimal
|
|
MONEY.TXT 11648 effort YOU can become a millionaire.
|
|
This text file, as some of you may know,
|
|
is simply another chain (pyramid) letter
|
|
that is of course illegal. A pyramid
|
|
writer sends a letter to four people
|
|
requesting money. Then, according to
|
|
the pyramid writer's plan, those four
|
|
will send letters to four more asking
|
|
for money for themselves and the
|
|
original writer. Unfortunately when the
|
|
chain breaks people lose money. What
|
|
one person gains someone else must lose.
|
|
That's why this type of letter is
|
|
illegal.
|
|
MONOPOLY MG Finally I am SURE that this file
|
|
violates Parker Brother's rights
|
|
to the famous boardgame. Don Gibson has
|
|
agreed that monopoly should NOT be
|
|
distributed anymore, so SysOps, please
|
|
remove this file from your download
|
|
directories.
|
|
MOVBASIC or MU This highly illegal file breaks IBM's
|
|
SBASICA or copyright on BASIC and
|
|
BASICA. It SBASIC creates new files
|
|
called SBASIC or SBASICA that run "IBM
|
|
BASIC" on an IBM clone. C'mon, don't
|
|
you think that these clones don't run
|
|
IBM BASICA for a good reason? The
|
|
clones don't support BASICA because it's
|
|
illegal! This file comes with Alloy's
|
|
PC-Slave card. Alloy has a license
|
|
agreement, and users of the PC-Slave are
|
|
allowed to create copies of IBM BASIC
|
|
for themselves. NO ONE ELSE IS. Stop
|
|
complaining that this file is legal,
|
|
people; this is one of the more blatent
|
|
cases of piracy that I've seen.
|
|
XTALK MP Like Copywrite, there is a patch
|
|
circulating BBS's to remove the serial
|
|
numbers from Crosstalk.
|
|
|
|
------------------------------------------------------------------
|
|
| Many thanks for updates to version 8.0 from: |
|
|
------------------------------------------------------------------
|
|
| |
|
|
| 1. John Abolins |
|
|
| 2. Randall Splinter |
|
|
| 3. Mike Topf |
|
|
| 4. John White |
|
|
| 5. Gary Thomas |
|
|
| 6. Bob Ackerman |
|
|
| 7. Nich Sochs |
|
|
| 8. Don Gibson |
|
|
| 9. Russ Goodwin |
|
|
| 10. John White |
|
|
| 11. John Ford |
|
|
| 12. Bob Stone |
|
|
| 13. Cay Horstmann |
|
|
| 14. John Curran |
|
|
| 15. Gary Tivey |
|
|
| 16. Leo M. Cavanaugh III |
|
|
| 17. Darryl Merkley |
|
|
| 18. Arnie Bell |
|
|
| 19. You? |
|
|
------------------------------------------------------------------
|
|
|
|
|
|
|
|
This is the end of the "bad files list." The rest of this
|
|
document contains instructions on what to do if YOU run a trojan
|
|
horse, an update history, a glossary, and information on how and
|
|
where to contact me with updates.
|
|
|
|
|
|
|
|
|
|
|
|
------------------------------------------------------------------
|
|
| If you run a trojan horse.. |
|
|
------------------------------------------------------------------
|
|
|
|
|
|
While reading this, bear in mind that there is no better remedy
|
|
for a drive that has run a trojan horse than a recent backup..
|
|
|
|
AARGH! Perhaps your hard disk sounds like a sick moose. Perhaps
|
|
your drive light starts flashing repeatedly, like a police car's
|
|
lights. Perhaps your drive just sits in the computer, and the
|
|
computer doesn't acknowledge its presence.
|
|
|
|
Having watched my drive crash many times, I can understand the
|
|
frustration you will feel after your hard disk conks out. While a
|
|
faulty hard drive, disk controller, or cable can make these
|
|
ailments uncurable without spending a lot of money, usually you
|
|
CAN recover from a trojan horse with only investing a little time.
|
|
|
|
After running a trojan horse, the first thing to do is calm down.
|
|
Face the situation stoicly; it may prevent your hair from turning
|
|
gray. Diagnose the damage. Was your [hard] drive formatted?
|
|
Did the trojan scramble your FAT table? Did it erase every file?
|
|
Did it erase or format your [hard] drive's boot sector? The odds
|
|
are that the trojan incurred one of these four disasters.. After
|
|
a successful diagnosis, you are ready to remedy the problem.
|
|
|
|
|
|
1) If the trojan low-level formatted your [hard] disk:
|
|
|
|
Hope that you have a recent backup; that's the only remedy
|
|
for this disease.
|
|
|
|
2) If the trojan high-level formatted your [hard] disk:
|
|
|
|
About a year ago Paul Mace introduced a way to recover
|
|
formatted data. Unfortunately, most programs can only
|
|
recover formatted data COMPLETELY if you run a "snapshot"
|
|
program right before the format. The reason: DOS
|
|
fragments large files and without an accurate map of the
|
|
formatted disk, unformatters have problems dealing with
|
|
such files. You will need one of these three programs to
|
|
recover your disk if the trojan formatted it:
|
|
|
|
1. PC-Tools (Central Point, $79.95 retail)
|
|
2. Mace+ Utilities (Paul Mace $99.95 retail)
|
|
3. Advanced Norton Utilities (Peter Norton, $150.00
|
|
retail)
|
|
|
|
There is at least one other program that can unformat
|
|
disks, but the name of it is slipping my mind. As of this
|
|
printing, PC-Tools probably has the best unformatter. It
|
|
can reputedly reconstruct formatted disks regardless of
|
|
the disks state of fragmentation. PC-Tools may not be
|
|
right for your other disk management needs, however, so
|
|
you should talk to a salesmen about these products before
|
|
making a purchase.
|
|
|
|
3) If the trojan scrambled your FAT table:
|
|
|
|
Sector editors such as those included in the Norton
|
|
Utililites, PC-Tools, and a host of other popular utility
|
|
packages (not Mace+) allow experienced users to piece
|
|
their FAT backtogether from Gibberish. This avenue of
|
|
recovery is only open to extremely proficient users,
|
|
however. Everyone else, including myself, must rely on a
|
|
FAT backup program to provide a feeling of security.
|
|
FATBACK.COM (available on my board) will back up your FAT
|
|
table in under a minute to floppy. FATBACK makes FAT
|
|
backup easy and non time consuming.
|
|
|
|
4) If the trojan erased file(s), and the FAT table is
|
|
undamaged:
|
|
|
|
There are many commercial and public domain packages
|
|
available that undelete deleted files. Norton Utilities,
|
|
PC-Tools, MACE+, and UNDEL.COM will all do the job. The
|
|
commercial products are all more reliable in undeleting,
|
|
but they are also more expensive that the Public-Domain
|
|
UNDEL. Always undelete your most recent files first; that
|
|
is, undelete files in the order of last time written to
|
|
disk. I know that PC-Tools automatically lists
|
|
undeletable files in the correct order, but the other
|
|
three may not.
|
|
|
|
5) If the boot sector on your hard disk gets
|
|
erased/formatted:
|
|
|
|
There are four things to do if this happens, and the
|
|
worst that can happen is that you will go without a hard
|
|
disk for a while. Backup before proceeding with any of
|
|
the steps here, for you may have to destroy some files to
|
|
restore your hard disk to boot status.
|
|
|
|
A) Try doing a "SYS C:" (or "SYS A:") from your
|
|
original DOS disk. Then copy COMMAND.COM back onto
|
|
the hard drive. If your hard drive still won't boot
|
|
then try step B.
|
|
|
|
B) If you have the MACE+ utilities go to the "other
|
|
utilities" section and "restore boot sector." This
|
|
should do the job if you have been using MACE+
|
|
correctly.
|
|
|
|
C) If you are still stuck, BACK EVERYTHING UP and
|
|
proceed to do a low level format. Instructions on
|
|
how to perform a low-level format should come with
|
|
your hard disk controller card. Be sure to map out
|
|
bad sectors using either SCAV.COM by Chris Dunford
|
|
or by manually entering the locations of bad sectors
|
|
into the low level format program. After the low
|
|
level format run FDISK.COM (it comes with DOS) to
|
|
create a DOS partition. Refer to your DOS manual
|
|
for help in using FDISK. Then put your original DOS
|
|
diskette in drive A: and type FORMAT <drive
|
|
letter>:/S/V. <Drive letter> represents the letter
|
|
of the disk you are formatting. Try rebooting
|
|
again.
|
|
|
|
D) If you are still stuck, either employ some
|
|
professional computer repairmen to fix your drive,
|
|
or live with a non-bootable hard drive..
|
|
|
|
|
|
|
|
------------------------------------------------------------------
|
|
| Update History: |
|
|
------------------------------------------------------------------
|
|
|
|
Version 1.0 Tom Neff enters a dozen "bad" files in the
|
|
initial "dirty dozen."
|
|
|
|
Version 2.0 Sees the addition of a short introduction and 3
|
|
more files. Again, I play no role in this
|
|
version.
|
|
|
|
Version 3.0 I write version 3.0. Tom Neff appears to have
|
|
lost interest in the DDoz, so I take over. I
|
|
add 22 files and completely rewrite the
|
|
introduction. Version 3.0 has a total of 37
|
|
files.
|
|
|
|
Version 4.0 I add another 30 or so files to the list,
|
|
making the DDoz 65+ files strong, as well as
|
|
adding a few paragraphs to the introduction.
|
|
|
|
Version 5.0 By the time I release version 5.0 to the
|
|
public, the Dirty Dozen is being greeted
|
|
favorably and with enthusiasm around the
|
|
country. Updates start coming in with
|
|
regularity; the list prospers (if one can say
|
|
that about a list!). I add a few more
|
|
paragraphs to the introduction and about 40 new
|
|
files bringing the file total up to 103!
|
|
|
|
Version 6.0 The Dirty Dozen is now such a big project that
|
|
I am now writing it in stages. Although I am
|
|
going to make absolutely no effort to spread
|
|
these "intermediate versions," they will always
|
|
be downloadable from my board. This way
|
|
everyone can keep an extremely current, if only
|
|
minorly modified, issue of the DD. You might
|
|
think of stage "a" of issue #6 as version 6.1,
|
|
stage "b" as version 6.2, stage "c" as version
|
|
6.3, etc.
|
|
|
|
New in version 6.0 is the following:
|
|
|
|
A) Many minor revisions,
|
|
B) 17 more files, bringing the total to
|
|
120!
|
|
C) Two new paragraphs in the introduction,
|
|
D) Instructions on how to recover from a
|
|
trojan horse,
|
|
E) A comprehensive glossary,
|
|
F) This update history,
|
|
G) An acknowledgments section set up for
|
|
major contributors of information
|
|
regarding new bogusware
|
|
H) A new bogusware catagory of
|
|
"miscellaneous illegal software."
|
|
|
|
Version 7.0 The major changes in this version take place
|
|
in the revision stages. From 6.0a to 6.0l I
|
|
add fifteen trojan horses, six commercial
|
|
programs, two miscellanous files, and two
|
|
hacked programs. I also rewrite part of the
|
|
introduction, adding a paragraph, and I augment
|
|
the glossary at the end of this document.
|
|
While 6.0l contains a good deal of version 7.0;
|
|
however, version 7.0 is considerably different
|
|
than 6.0l. For example, I add seventeen new
|
|
pirated programs, bringing the file total to a
|
|
whopping 165! Moreover, I rewrite virtually
|
|
every paragraph in order to 'stylize' (clean up
|
|
the writing in) the document.
|
|
|
|
Once again I would like to thank all users who
|
|
called in updates to the Dirty Dozen; such
|
|
users encourage me to keep maintaining the
|
|
dirty dozen!
|
|
|
|
Version 8.0 One of my hard disks has been down for about
|
|
six months. Unfortunately version 8.0 was
|
|
ready for release RIGHT before the hard disk
|
|
crash, and, naturally, the new version was on
|
|
the busted HD un-backed-up. Finally I've taken
|
|
the time (about 50 hours) to just sit down and
|
|
work with the Dirty Dozen. I feel guilty that
|
|
I've held back the DDoz for so long, but
|
|
fortunately until recently there have been NO
|
|
trojan horses to report. In anycase, I have
|
|
modified v. 7.0 of the Dirty Dozen extensively;
|
|
changes include:
|
|
|
|
1) New illegal software category: VIRUS.
|
|
Virii are potentially more dangerous than
|
|
trojan horses.
|
|
|
|
2) New illegal software category: CAREFUL
|
|
These file are suspect; excercise caution
|
|
when running these unverified programs.
|
|
|
|
3) All paragraphs rewritten. There were
|
|
quite a few cases of ambiguity in version 7.0;
|
|
now I hope to have eliminated those cases.
|
|
|
|
4) New Field added for filesize. One of
|
|
these days trojan horse authors will think and
|
|
start uploading old trojans using new
|
|
filenames. To combat this possibility, the
|
|
Dirty Dozen now holds a filesize for EVERY new
|
|
file added. This way you can crossreference
|
|
file descriptions and filesizes to nip a trojan
|
|
in the bud.
|
|
|
|
5) The Dirty Dozen is now printable. The
|
|
right margin is now 66, so all printers should
|
|
be able to print the DDoz without printing off
|
|
the right side of the paper.
|
|
|
|
6) 1 new Virus added.
|
|
7) 9 New Trojan Horses added
|
|
8) 22 New Pirated programs added
|
|
9) 0 New Hacked programs added
|
|
10) 2 New Miscellaneous files added
|
|
11) 1 New Careful file added
|
|
12) Glossary Update
|
|
|
|
Total bad files listed: 200
|
|
|
|
|
|
Version 8.0a New:
|
|
|
|
Miscellaneous : 1
|
|
Trojan : 4
|
|
Viral : 3
|
|
Commercial : 3
|
|
|
|
|
|
I also update five or six glossary terms, a
|
|
paragraph about protecting COMMAND.COM
|
|
from virii, and two trojan horse entries.
|
|
|
|
Version 8.0b New:
|
|
|
|
Miscellaneous : 0
|
|
Trojan : 3
|
|
Viral : 0
|
|
Commercial : 8
|
|
|
|
Updated:
|
|
|
|
Miscellaneous : 1
|
|
Trojan : 2
|
|
Viral : 1
|
|
Commercial : 0
|
|
|
|
Note: I still have quite a few pirated files to add,
|
|
but in the interest of warning YOU of all the new trojans recently
|
|
released, I will hold those pirated files off for version 8.0c
|
|
|
|
Dates of release:
|
|
|
|
Version 1.0 -- October 20, 1985.
|
|
Version 2.0 --
|
|
Version 3.0 --
|
|
Version 4.0 --
|
|
Version 5.0 --
|
|
Version 6.0 --
|
|
Version 7.0 -- January 3, 1987.
|
|
Version 8.0 -- February 5, 1988.
|
|
Version 8.0a-- February 21, 1988.
|
|
Version 8.0b-- April 4, 1988.
|
|
|
|
|
|
------------------------------------------------------------------
|
|
| Glossary: |
|
|
------------------------------------------------------------------
|
|
| |
|
|
| This glossary is for the beginning to intermediate level |
|
|
| user. Experienced users can skip this with confidence. All |
|
|
| users should use this as a reference since this material makes |
|
|
| for exceptionally droll. reading. |
|
|
| |
|
|
------------------------------------------------------------------
|
|
|
|
|
|
?Q? -- ('?' represents any character) File extension for
|
|
SQueezed files. Squeezed files are unusable until
|
|
unsqueezed by a utility such as NUSQ.COM or
|
|
USQ.COM. The advantage of a SQueezed file is that
|
|
it is smaller than a regular UnSQueezed file,
|
|
thus saving disk space and download time.
|
|
ARChives are more efficient than Squeezed files;
|
|
that's why there are so many more ARChives on
|
|
BBS's these days. Example of the extensions of
|
|
SQueezed files: .EQE, .CQM, .LQR, .TQT, .DQC,
|
|
etc.
|
|
ABBRV -- Abbreviation for the word: "abbreviation"
|
|
ARC -- File extension for an ARChive file -- many files
|
|
combined together to save space and download time
|
|
that require ARC.EXE, PKXARC.COM, ARCE.COM, or
|
|
ARCLS.EXE to separate the files in to runnable and
|
|
readable (in the case of text) form.
|
|
BAS -- Abbrv for "BASIC," as in the programming language
|
|
BBS -- Abbrv for "Bulletin Board System"
|
|
BBS's -- Abbrv for "Bulletin Board Systems"
|
|
BOARD -- Also "Bulletin Board System"
|
|
BOGUSWARE -- Software that is damaging to one or more parties
|
|
BOOT or -- To boot a computer is to restart it from scratch,
|
|
REBOOT erasing all TSR programs. One reboots by either
|
|
powering off and then back on, or pressing
|
|
Ctrl-Alt-Del at the same time.
|
|
BYTES -- Bytes measure the length of a file, with one byte
|
|
equaling one character in a file.
|
|
CACHE [disk] -- Area of memory set aside to hold recent data. All
|
|
programs then read recent data from that memory
|
|
rather than from disk.
|
|
CLUSTER -- A phyical block on all [hard] disks, composed of
|
|
sectors, that holds data.
|
|
COM -- File extension for a file that is executable from
|
|
DOS level
|
|
DD -- Abbrv for "dirty dozen"
|
|
DEBUG -- Either (V) to remove glitches in a program or (N)
|
|
the assembly language editor/compiler/disassembler
|
|
provided with DOS
|
|
DOC -- Abbrv for "documentation"
|
|
EMS -- Enhanced Memory Specification. An EMS card holds 2
|
|
MB extra mem.
|
|
EXE -- file extension for a file that is executable from
|
|
DOS level
|
|
FAT -- File Allocation Tables - First sectors of [hard]
|
|
disks where file sizes and physical locations
|
|
are stored.
|
|
FRAGMENT -- DOS physically saves files all over disks-not
|
|
continously this slows down drives and cause
|
|
problems for recovering deleted files or formatted
|
|
disks.
|
|
HACKED -- See "definitions" section
|
|
HIDDEN -- A "hidden" file will not show up in a 'dir'ectory
|
|
HIGH LEVEL
|
|
FORMAT -- This type of format is what most computer users
|
|
view as a regular DOS-format. That is, formatting
|
|
a disk using FORMAT.COM (included with DOS) is a
|
|
high level format.
|
|
IBM -- International Business Machines
|
|
IBMBIO.COM -- Hidden, System, Readonly file used by DOS
|
|
IBMSYS.COM -- Hidden, System, Readonly file used by DOS
|
|
IBM OR COMP -- IBM computer or a 99% or greater IBM Compatible
|
|
computer
|
|
KB -- Abbreviation for "KiloBytes," one Kb equals 1024
|
|
bytes
|
|
LBR -- Extension on Library files. Library files are
|
|
really many combined files like ARChives, but they
|
|
require different utilities to extract the
|
|
individual files. Some examples of such utilities
|
|
are LUU.EXE, LUE.EXE, LAR.EXE, AND ZIP.EXE. See
|
|
"ARC"
|
|
LOW LEVEL
|
|
FORMAT -- This type of format is only executed on a hard
|
|
disk, therefore most hard disk low-level format
|
|
programs come only with a hard disk controller
|
|
card. There are a few PD low-level formatting
|
|
packages, though. Most manufacturers low-level
|
|
format their hard drives at the factory. Low
|
|
level formatting is the first step in the three
|
|
part formatting process; the second step is to use
|
|
FDISK, and the third is to execute a high level
|
|
format.
|
|
MB -- Abbrv for "Megabytes," or "millions of bytes."
|
|
MISC -- Abbrv for "miscellaneous"
|
|
OPTIMIZE -- To make all files on a disk "contiguous," or
|
|
physically linked together on a [hard] drive.
|
|
PATCH -- A file that is patched (combined) into another
|
|
file to change the original file in some way
|
|
PD -- Abbrv for "Public Domain"
|
|
PKXARC -- Phil Katz's ARChive extracter
|
|
PIRATED -- See DEFINITIONS section in this issue.
|
|
RAM -- Abbrv for "Random Access Memory." (memory used by
|
|
software)
|
|
RBBS -- Abbrv for RBBS-PC, a type of BBS (Remote Bulletin
|
|
Board System)
|
|
READONLY -- One can NOT write to "readonly" files (ie erasing)
|
|
ROM -- Abbrv for "Read Only Memory." (memory used by
|
|
hardware to boot)
|
|
SQUASHING -- File compression technique used by PKXARC but not
|
|
by SEA's ARC.EXE
|
|
SYSOP -- SYStem OPerator of a BBS
|
|
SYSTEM -- DOS reserves a "System" file for its own use
|
|
TROJAN -- See DEFINITIONS section in this issue.
|
|
TROJAN HORSE -- See DEFINITIONS section in this issue.
|
|
TSR -- Abbv for "Terminate, Stay Resident" Synonym =
|
|
"Memory Resident"
|
|
TXT -- Abbrv for "text"
|
|
USU -- Abbrv for "usually"
|
|
UNP -- Abbrv for "unprotect"
|
|
UNPROTECT -- An "unprotect file" is a patch file that results
|
|
in the breaking of copy protection (no doubt for
|
|
back up purposes).
|
|
UTIL -- abbrv for "utility"
|
|
VIRUS -- See definition section
|
|
WORM -- Trojan Horse
|
|
|
|
|
|
------------------------------------------------------------------
|
|
| Update Information: |
|
|
------------------------------------------------------------------
|
|
|
|
|
|
If you have any additions or corrections for this list, send them
|
|
to Eric Newhouse at any of the following places. Please be sure
|
|
to leave the problem file name, size, and description. Please
|
|
note that the West LA PC-Store is currently DOWN. Thank You.
|
|
|
|
(in order of most frequented):
|
|
|
|
|
|
* The Crest RBBS/CAMS (213-471-2518) (1200/2400)
|
|
(160/50 MB) [ This is my board ]
|
|
|
|
* The Dirty Dozen List [ this is my mailing address ]
|
|
c/o Eric Newhouse
|
|
1834 Old Orchard Rd
|
|
Los Angeles, CA, 90049
|
|
|
|
D * The West LA PC-STORE (213-559-6954) (300/1200/2400)
|
|
(50 MB)
|
|
|
|
* Camelot PC-Board (213-204-6158) (300/1200/2400)
|
|
(80 MB?) (leave mail to "NORMAN TEETER." He will reley
|
|
your message).
|
|
|
|
* The Source (leave E-mail to "Doctor File Finder" in IBM SIG
|
|
#4). Doctor File Finder (Mike Callahan) will
|
|
relay your update to me.
|
|
|
|
|
|
------------------------------------------------------------------
|
|
| Finally: |
|
|
------------------------------------------------------------------
|
|
|
|
Many people have asked about donating for the Dirty Dozen
|
|
service. Considering that in the last six months I've lost 160 MB
|
|
worth of disk drives, a floppy drive, and a modem to equipment
|
|
failure, I've decided to start accepting donations.
|
|
|
|
Please understand, however, that there is a difference
|
|
between accepting and soliciting. I am NOT soliciting donations.
|
|
The Dirty Dozen list is a free service, and I take pleasure in
|
|
helping oºher people avoid trojan horses and other illegal
|
|
programs.
|
|
|
|
If, however, you'd like to support this list -- if you'd like
|
|
to see the Crest BBS go back up in the near future, I guarantee
|
|
that all donations will be used to buy new BBS equipment.
|
|
|
|
All checks can be sent to my mailing address made out to Eric
|
|
Newhouse. Thank You; even if you don't donate, I appreciate that
|
|
you've read this document all the way through and that now perhaps
|
|
you too can help in the war agaisnt illegal software.
|
|
|
|
-----------------------------------------------------------------
|
|
END.
|
|
|