Newsgroups: bit.listserv.games-l
Date:         Mon, 27 Jul 1992 16:00:20 -0500
Reply-To:     "'Craig Hansen-RRTH80' <Craig-Hansen-RRTH80@email>"
              <ICRSD@ASUACAD.BITNET>
From:         "'Craig Hansen-RRTH80' <Craig-Hansen-RRTH80@email>"
              <ICRSD@ASUACAD.BITNET>
Subject:      MCERT: CIAC c-27.PKZIP.Trojan.Alert.mcert

 Hey, guys.  Sorry for the mile long headers, but of certain restrictions
 it is necessary for me to keep them.  PLEASE *DO* read this.  It could
 save quite a bit of trouble.

 -- R. Dodd
    (ICRSD@ASUACAD.BITNET)                Internet:
    (AXROB@ASUACAD)                       (@asuvm.INRE.ASU.EDU)
    (602) 965-1211    "Sanity is for the unimaginative."
 *** Forwarding note from IDMER   --ASUACAD  07/27/92 13:48 ***
 To: ICRSD   --ASUACAD  Robert Dodd

       Computer Accounts Office  5-4656

 FYI - if it's something you use.

 Evelyn
 *** Forwarding note from ICSMLL  --ASUACAD  07/27/92 13:17 ***
 Received: by ASUACAD (Mailer R2.08) id 4828; Mon, 27 Jul 92 13:17:47 MST
 Date:         Mon, 27 Jul 1992 13:08:34 MST
 Reply-To:     Marilyn Lowe <ICSMLL@ASUACAD.BITNET>
 Sender:       "Computing Consultants Cooperative" <ICCCC@ASUACAD.BITNET>
 Comments:     Resent-From: Marilyn Lowe <ICSMLL@ASUACAD>
 Comments:     Originally-From: "{Eddie Gonzalez{
               <Eddie_Gonzalez@tempeqm.sps.mot.com>" <EDDIEGON@CMSNAMES>
 To:           Evelyn Roberts <IDMER@ASUACAD.BITNET>

 If you can wade through all the header/forwarding info on this, there is
 a really important bit of news. Thanks to Dave McKee for passing it along.
 The reason I left in all the header stuff is so you can see where the info
 came from, which was a topic among members on earlier unconfirmed messages.
      ----------- Marilyn Lowe

 ***************************************************************************
 * Marilyn Lowe                                                            *
 * Arizona State University       Life still contains surprises!           *
 * Tempe, AZ 85287-0101                                                    *
 * ICSMLL@ASUACAD                 (602)965-4383                            *
 ***************************************************************************
 ----------------------------Original message----------------------------


 In case you would like to pass this (or a portion of it) on to the CCC.

 - David M. McKee
 - Manager, IRM Data Communications - Arizona State University
 - Phone: 602-965-4016   Fax: 602-965-0963
 - Internet: ICSDMM@asuvm.inre.asu.edu  Bitnet: ICSDMM@ASUACAD
 ---------------------------Original Message----------------------------
 X-Delivery-Notice:  SMTP MAIL FROM does not correspond to sender.
 Received: from ASUACAD (SMTP) by ASUVM.INRE.ASU.EDU (Mailer R2.08) with BSMTP
  id 0383; Mon, 27 Jul 92 09:57:06 MST
 Received: from relay1.UU.NET by ASUVM.INRE.ASU.EDU (IBM VM SMTP V2R2) with TCP;
    Mon, 27 Jul 92 09:57:04 MST
 Received: from spsgate.sps.mot.com by relay1.UU.NET with SMTP
 	(5.61/UUNET-internet-primary) id AA10342; Mon, 27 Jul 92 12:55:24 -0400
 Received: by spsgate.sps.mot.com (4.1/SMI-4.1)
 	id AA07545; Mon, 27 Jul 92 09:55:22 MST
 Message-Id: <9207271655.AA07545@spsgate.sps.mot.com>
 Received: from emailchd (email.sps.mot.com) by motsps (4.1/SMI-4.0)
 	id AA15112; Mon, 27 Jul 92 09:50:14 MST
 Date: 27 Jul 1992 09:54:26 U

 To: "ASU-Dave McKee" <icsdmm@asuvm.inre.asu.edu>,
         "KVRY-Robert Reymont" <71645.254@compuserve.com>

 GatorMail-Q                   FWD>MCERT: CIAC c-27.PKZIP.Troj
 FYI

 --------------------------------------
 Date: 7/27/92 8:01 AM
 FYI--
 I am resending this MCERT to the UNIC Council mailing list.  I
 realize that you are UNIX users and not DOS users.  However, many
 have PCs at home, etc., and many people use the PKZIP utility.

 Craig

 Begin forwarded message:

 Date: Fri, 24 Jul 92 16:45:41 MST

 To: "Craig Hansen" <craigh@domino.sps.mot.com>


 To:		MCERT distribution list
 Date:		7/24/92
 Subject:	CIAC C-27 PKZIP Trojan Alert
 Sensitivity:	Motorola General Business Information


         _____________________________________________________
              The Computer Incident Advisory Capability
                          ___  __ __    _     ___
                         /       |     / \   /
                         \___  __|__  /___\  \___
         _____________________________________________________
                            INFORMATION BULLETIN

                             PKZIP Trojan Alert

 JULY 8, 1992, 1700 PT                                  Number C-27

 _____________________________________________________________________
 ___
 PROBLEM:  Bogus versions of the PKZIP archiving software have been

           released to Bulletin Board Systems (BBS).
 PLATFORM: PCs running PC-DOS, or MS-DOS
 DAMAGE:   One version attempts to erase the hard disk.
 DETECTION: Look for the files: PKZ201.ZIP, PKZ201.EXE, PKZIPV2.ZIP,
 or
           PKZIPV2.EXE

 REMOVAL:  Save a copy of the files for CIAC, then delete the files.
 Do
           not extract or run these files.
 _____________________________________________________________________
 ___
                 Critical Facts about the PKZIP Trojan



 CIAC has learned that two bogus versions of the popular archiving
 utility PKZIP for PC-DOS and MS-DOS machines are being circulated on
 several BBSs around the country. The two bogus versions of PKZIP are,
 2.01 (PKZ201.ZIP and PKZ201.EXE) and 2.2 (PKZIPV2.ZIP and
 PKZIPV2.EXE).  If you have downloaded any of these files, do not
 attempt to use them.  You risk the destruction of all the data on
 your
 hard disk if you do.

 At the current time, the released version of PKZIP is version 1.10. A
 new version of PKZIP is expected to be released in the next few
 months.
 Its version number was planned to be 2.00, but may be increased to a
 number greater than 2.2 to prevent confusion with the bogus versions.
 PKWARE Inc. has indicated it will never issue a version 2.01 or 2.2
 of
 PKZIP. A good copy of the latest version of PKZIP can always be
 gotten
 from the PKWARE BBS listed below.

 According to PKWARE Inc. version 2.01 is a hacked version of PKZIP
 1.93
 Alpha.  While this version does not intentionally do any damage, it
 is
 alpha level software, and may have serious bugs in it.

 Version 2.2 is a simple batch file that attempts to erase your C:\
 and
 C:\DOS directories. If your hard disk has been erased by this
 program,
 you may be able to recover it using hard disk undelete utilities such
 as those in Norton Utilities, or PCTools. Don't do anything that
 might
 create or expand a file on your hard disk until you have undeleted
 the
 files, as you may overwrite the deleted files which will destroy
 them.
 To examine a file to see if it is version 2.2, type it to the screen
 with the DOS TYPE command. If the file that prints on the screen is a
 short batch file with commands such as DEL C:\*.*, or DEL C:\DOS\*.*
 then you have the bogus file.

 If you should happen to see any of these files on a BBS, please
 contact
 the sysop of that BBS immediately, and ask him to remove them. If you
 have downloaded one of these files, please save a copy for CIAC, and
 then delete the files from your hard disk. PKWARE Inc. has also asked
 to be informed of any occurrences of these files, and can be reached
 at,

      Voice: 414-354-8699    BBS: 414-354-8670    FAX: 414-354-8559

 or by mail:

      PKWARE Inc.
      9025 N. Deerwood Drive
      Brown Deer, WI 53223 USA

 For additional information or assistance, please contact CIAC:

      CIAC at (510) 422-8193/(FTS)
          FAX (510) 423-8002/(FTS)
      send e-mail to ciac@llnl.gov.

 PLEASE NOTE:  Many users outside of the DOE and ESnet computing
 communities receive CIAC bulletins. If you are not part of these
 communities, please contact your agency's response team to report
 incidents. Some of the other teams include the NASA NSI response
 team,
 DARPA's CERT/CC, NAVCIRT, and the Air Force response team. Your
 agency's team will coordinate with CIAC.

 CIAC would like to acknowledge the contribution of: PKWARE Inc.

 This document was prepared as an account of work sponsored by an
 agency
 of the United States Government. Neither the United States Government
 nor the University of California nor any of their employees, makes
 any
 warranty, express or implied, or assumes any legal liability or
 responsibility for the accuracy, completeness, or usefulness of any
 information, apparatus, product, or process disclosed, or represents
 that its use would not infringe privately owned rights. Reference
 herein to any specific commercial products, process, or service by
 trade name, trademark, manufacturer, or otherwise, does not
 necessarily
 constitute or imply its endorsement, recommendation or favoring by
 the
 United States Government or the University of California. The views
 and
 opinions of authors expressed herein do not necessarily state or
 reflect those of the United States Government or the University of
 California, and shall not be used for advertising or product
 endorsement purposes.


 ---------------------------------------------------------------------
 --

 Past advisories and other computer security related information are
 available via anonymous FTP from 'ftpbox.mot.com' (129.188.136.101).
 They are located in the directory pub/security.  Advisories are also
 posted in the Motorola BBS newsgroup 'mot.misc.security.announce'.
 The newsgroup 'mot.misc.security.misc' has been established as a
 forum
 for discussion of security-related issues within Motorola.

 John Kinyon, Network Security Manager, Corporate Info Security/Risk
 Management
 Motorola, Inc., 1299 E. Algonquin Road, IL06-2nd, Schaumburg, IL
 60196-1077
 Phone: +1 708 576 0669,  Fax: +1 708 576 2259,  E-mail:
 kinyon@corp.mot.com
 Motorola's Distributed X.400 E-mail: John_Kinyon-CEMX52



 ------------------ RFC822 Header Follows ------------------
 Received: by tempeqm.sps.mot.com with SMTP;27 Jul 1992 08:01:01 U
 Date: Mon, 27 Jul 92 07:56:24 MST
 To: UnixCouncil@domino
Comments: Gated by NETNEWS@AUVM.AMERICAN.EDU