bamcpherson@trillium.waterloo.edu (Brent McPherson) (12/16/88)
I AM POSTING THIS ON BEHALF OF A FRIEND. PLEASE DIRECT ALL REPLIES TO utzoo!utgpu!ontmoh!moore!dhstor!greg or followup directly to this group. My friend was going through his command directory and found an unrecognized executable. He ran it and it printed the message "converted". About two weeks later while formatting a disk in A: the format command attempted to format C: instead! Upon closer inspection my friend discovered that "format.com" had been replaced with "format.exe" that was 161,610 bytes. This file appeared to be compiled DBASE (clipper)! There is also a format.tmp which is 11,616 bytes. The date on these files is 03/18/87. It took about two weeks before format messed up and he can't remeber the name of the original file (that printed to message) since he deleted it. It appears to be a quite simple trojan and no damage seems to have been done but my friend would like to know if any others have heard of this trojan and could give him any information. Thanks in advance.