From: cgordon@vpnet.chi.il.us (gordon hlavenka)
Subject: Re: Warning about PKZIP 3.05 -- PLEASE READ!!!
Organization: Vpnet Public Access
Date: Thu, 05 Nov 1992 06:41:19 GMT

 dsembr01@starbase.spd.louisville.edu (Darren S. Embry) writes:
>This is an exact (well ... re-typed) copy of a "broadcast" letter sent to
>all members and affiliates of THIEVCO, INC., a group located somewhere in
>the San Francisco Bay Area...
>
>Note that while I do not support the general ideology of Thievco, Inc.
>(presumably a group of computer criminals), I must applaud their actions.

The document sounds mostly like a hoax.  If some legion of hackers
"accidentally" released a potent virus, they'd be proud of it rather
than otherwise.  Why warn the public?  It'd be more fun to watch the
fireworks.

>	At 7:34 p.m. (pacific standard time), our attempt to isolate and
>contain the PROTO-T virus failed.

Yeah, right.  They're sitting around in lab coats with a chronometer,
being sure to note the _exact_ time the virus "escaped" their lab.

>As we have discovered, PROTO-T has a
>*very* unique feature, to hide in the RAM of VGA cards, hard disks, and
>possibly, in modem buffers.

OK.  It is possible to load code into the RAM of EGA and VGA cards.
You can even point CS:IP there and execute it.  But, like most of the
RAM in your machine, this dies when you power down -- and the video
RAM is explicitly cleared during a reboot.  Many hard disks have
substantial amounts of RAM on them, used for caching and track
buffers.  But the processor bus doesn't connect to this RAM.  There's
no way to execute from it.  MODEM BUFFERS?  Give me a break.  (Pun
intended :-)

> At this time, there is known defense against this virus, save
>formatting your hard/floppy disks--there isn't even a method of detecting it
>yet . . . until it's too late.

OK.  This is actually the worst kind of trojan.  Undetectable by any
scanner, it resides in a _text_ file and really can cause data loss.
How?  By making innocent people reformat their drives "just to be
sure."  And it replicates and spreads using the same anti-stealth
methodology employed by most .sig viruses.  Insidious.

>	Please assist us in implementing this plan, to warn the general
>public.  Our first priority is our fellow THIEVCO members.

Make up your mind.  General public?  Or Thievco members?

>distribute this letter to all contacts inside the United States, upon
>receipt of this letter.

This starts sounding like a poorly-written chain letter.

>	Blue Boar -- Distribute the warning in Southern CA, start with L.A.
>		first.
>  (etc.)

Nobody was assigned to warn the internet? What are we, chopped liver?
Sheesh.  Besides, a _real_ hacker would automate this warning and
blanket FAX and modem connections across the country.  In about an
hour.

>	Upon infection, the virus is written (as unattached file chains) on
>two parts of a hard disk--each capable of running independently without the
>other half.

How does it get from here into memory?

>	After infection, the virus seems to be written into the memory or
>memory routines of a VGA or EGA monitor; or it is written into the memory of
>the hard drive; or quite possibly into a modem or COM port, thus escaping
>most known detection methods.

Poorly written technobabble.

>	PROTO-T, when activated, corrupts data on a disk, stops EGA or VGA
>from being used (thus either defaulting to CGA or locking up), and prohibits
>memory from being used over 512K.

Can't corrupt the ROMs on EGA / VGA cards.  And the RAM won't even
survive a warm boot, much less a powerdown.  More technobabble.

>	Known to be put in two files: TEMPLE.EXE (14,771 bytes) and PKZIP
>3.xx (varies).  If you see these files -- DO NOT GET OR USE THEM!!!!!!!!

First useful piece of information:  Don't run any version of PKZIP
higher than 1.93.  (What PKWARE is going to call their program when
it's finally released I can't even guess.  But I'll bet it won't be
PKZIP!  Too many ripoffs.)

-- 
----------------------------------------------------
Gordon S. Hlavenka           cgordon@vpnet.chi.il.us
Vote straight ticket Procrastination party Dec. 3rd!