[comp.sys.atari.st] ST User Virus!

imt@crosfield.co.uk (ian taylor) (05/28/91)

(This is probably only of interest to UK netters, although I believe ST User
magazine is available internationally by mail order)

Has anyone had problems with this months (June) ST User cover disk?
I think that there is a free virus included on the coverdisk, which mangled
the directory of two of my disks before I eradicated it. This is the second
time that ST User has done this, and frankly I am bloody unimpressed. Anyone
who's got this disk, beware.

jimomura@lsuc.on.ca (Jim Omura) (05/29/91)

In article <10099@suns2.crosfield.co.uk> imt@crosfield.co.uk (ian taylor) writes:
>(This is probably only of interest to UK netters, although I believe ST User
>magazine is available internationally by mail order)
>
>Has anyone had problems with this months (June) ST User cover disk?
>I think that there is a free virus included on the coverdisk, which mangled
>the directory of two of my disks before I eradicated it. This is the second
>time that ST User has done this, and frankly I am bloody unimpressed. Anyone
>who's got this disk, beware.


     Having read this message I immediately checked a bunch of my floppies.
I used a recent version of VKiller.  I *did* find a virus, but I'm not
certain it came from the June ST User disk.

     VKiller reported the "Green Goblin" virus.  I'm not sure where
this virus usually resides, but when I checked my June ST User disk
VKiller reported no virus present.  It didn't find a virus on any of
10 other disks I also checked.  This brings to mind that 1 of the things
I looked at from the Net recently was this "only_ste.lzh" sound
demo package.  Now this is a strange package with what seems to
be a whole disk compressed into an ".MSA" file which in turn was
LHARC'd.  I unpacked this kit just this morning.  When I unpacked
the disk I used the MSA.PRG auto-formatting command.  It seems to
me that this method of packaging might allow for transporting of
boot sector or other viruses.  Has anybody else unpacked this demo
kit recently?
-- 
Jim Omura, 2A King George's Drive, Toronto, (416) 652-3880
lsuc!jimomura
Byte Information eXchange: jimomura

jimomura@lsuc.on.ca (Jim Omura) (05/29/91)

In article <1991May28.202555.16251@lsuc.on.ca> jimomura@lsuc.on.ca (Jim Omura) writes:
>In article <10099@suns2.crosfield.co.uk> imt@crosfield.co.uk (ian taylor) writes:
>>(This is probably only of interest to UK netters, although I believe ST User
>>magazine is available internationally by mail order)
>>
>>Has anyone had problems with this months (June) ST User cover disk?
>>I think that there is a free virus included on the coverdisk, which mangled
>>the directory of two of my disks before I eradicated it. This is the second
>>time that ST User has done this, and frankly I am bloody unimpressed. Anyone
>>who's got this disk, beware.
>
>
>     Having read this message I immediately checked a bunch of my floppies.
>I used a recent version of VKiller.  I *did* find a virus, but I'm not
>certain it came from the June ST User disk.
>
>     VKiller reported the "Green Goblin" virus.  I'm not sure where
>this virus usually resides, but when I checked my June ST User disk
>VKiller reported no virus present.  It didn't find a virus on any of
>10 other disks I also checked.  This brings to mind that 1 of the things
>I looked at from the Net recently was this "only_ste.lzh" sound
>demo package.  Now this is a strange package with what seems to
>be a whole disk compressed into an ".MSA" file which in turn was
>LHARC'd.  I unpacked this kit just this morning.  When I unpacked
>the disk I used the MSA.PRG auto-formatting command.  It seems to
>me that this method of packaging might allow for transporting of
>boot sector or other viruses.  Has anybody else unpacked this demo
>kit recently?
>Jim Omura, 2A King George's Drive, Toronto, (416) 652-3880

     I have now checked about 2/3 to 3/4 of all my floppies (a few
hundred).  I found viruses on 6 disks (including the one I reported
earlier).  The pattern of infection does NOT point to either the
June 1991 ST User magazine disk, nor to the 'only_ste.lzh' file.
Rather, it looks like I probably received an infected disk about
a year ago.  Luckily, it just never had much of a chance to spread
on my disks.  I won't go into why this is so.  I have a fairly good
st dumb luck.  It's probably a good
idea for everyone to check their disks anyway in case I'm wrong,
but I don't think there's anything particular to worry about.
>lsuc!jimomura
>Byte Information eXchange: jimomura


-- 
Jim Omura, 2A King George's Drive, Toronto, (416) 652-3880
lsuc!jimomura
Byte Information eXchange: jimomura

grahamt@syma.sussex.ac.uk (Graham S Thomas) (05/29/91)

From article <10099@suns2.crosfield.co.uk>, by imt@crosfield.co.uk (ian taylor):
> (This is probably only of interest to UK netters, although I believe ST User
> magazine is available internationally by mail order)
> 
> Has anyone had problems with this months (June) ST User cover disk?
> I think that there is a free virus included on the coverdisk, which mangled
> the directory of two of my disks before I eradicated it. This is the second
> time that ST User has done this, and frankly I am bloody unimpressed. Anyone
> who's got this disk, beware.

I checked this out with George Woodside's VKILLER.  My disk is clean. 
It was formatted with Martin Backschat's FASTCOPY III, and has a
formatter ID of 'IBM' in bytes 3-5 of the bootsector, but the serial
number is OK - i.e. it doesn't correspond with an MS-DOS version number.

It looks like ST User is innocent this time.  (Innocent of this, at
least.  On the cover disk is what they call - several times - the 'very
latest version of UniTerm'.  The version is in fact 2.0c.  The last
version that Simon Poole released is, I believe, 2.0e011.  2.0c is quite
usable; if they didn't shout so much about the program being "hot from
the programmer's fingertips" - with a 1987 copyright date??? - I
wouldn't mind.)

Graham
-- 
Graham Thomas, SPRU, Mantell Building, U of Sussex, Brighton, BN1 9RF, UK
Email: grahamt@syma.sussex.ac.uk   Phone: +44 273 678165   Fax: .. 685865

woodside@ttidca.TTI.COM (George Woodside) (05/29/91)

In article <10099@suns2.crosfield.co.uk> imt@crosfield.co.uk (ian taylor) writes:
>Has anyone had problems with this months (June) ST User cover disk?
>I think that there is a free virus included on the coverdisk, which mangled
>the directory of two of my disks before I eradicated it. This is the second
>time that ST User has done this, and frankly I am bloody unimpressed. Anyone
>who's got this disk, beware.


And, anyone who's got the disk and VKILLER, please capture the virus and
forward a copy to me.

If it is indeed trashing disks, then it's different from the virus that
went out the first time.

-- 
* George R. Woodside - Citicorp/TTI - Santa Monica, CA *
* Path:       woodside@ttidca.tti.com                  *
*   or:       ..!{philabs|csun|psivax}!ttidca!woodside *

Roger.Sheppard@actrix.gen.nz (Roger Sheppard) (05/29/91)

In article <1991May28.202555.16251@lsuc.on.ca> jimomura@lsuc.on.ca (Jim Omura) writes:
> In article <10099@suns2.crosfield.co.uk> imt@crosfield.co.uk (ian taylor) writes:
> >(This is probably only of interest to UK netters, although I believe ST User
> >magazine is available internationally by mail order)
> >

> I looked at from the Net recently was this "only_ste.lzh" sound
> demo package.  Now this is a strange package with what seems to
> be a whole disk compressed into an ".MSA" file which in turn was
> LHARC'd.  I unpacked this kit just this morning.  When I unpacked
> the disk I used the MSA.PRG auto-formatting command.  It seems to
> me that this method of packaging might allow for transporting of
> boot sector or other viruses.  Has anybody else unpacked this demo
> kit recently?
> -- 
> Jim Omura, 2A King George's Drive, Toronto, (416) 652-3880
> lsuc!jimomura
> Byte Information eXchange: jimomura

I have just checked, it does have a executable boot sector, but its for
checking if you are using a Mono Monitor. ie. it gives a warning if not

-- 
Roger W. Sheppard   85 Donovan Rd, Kapiti New Zealand...

neil@cs.hw.ac.uk (Neil Forsyth) (05/30/91)

In article <5236@syma.sussex.ac.uk> grahamt@syma.sussex.ac.uk
(Graham S Thomas) writes:
>It looks like ST User is innocent this time.

Yes. Mine's clean too.

>  (Innocent of this, at
>least.  On the cover disk is what they call - several times - the 'very
>latest version of UniTerm'.  The version is in fact 2.0c. ...

You'll also find an illegal (very!) copy of NEOchrome on there too.
About now you'll all be saying "Why does this guy keep going on about
NEOchrome?". Well the answer is I would like it to be PD officially but Atari
seem disinterested.

>Graham Thomas, SPRU, Mantell Building, U of Sussex, Brighton, BN1 9RF, UK
>Email: grahamt@syma.sussex.ac.uk   Phone: +44 273 678165   Fax: .. 685865


+----------------------------------------------------------------------------+
! DISCLAIMER:Unless otherwise stated, the above comments are entirely my own !
!                                                                            !
! Neil Forsyth                      JANET:  neil@uk.ac.hw.cs                 !
! Dept. of Computer Science         ARPA:   neil@cs.hw.ac.uk                 !
! Heriot-Watt University            UUCP:   ..!ukc!cs.hw.ac.uk!neil          !
! Edinburgh, Scotland, UK           "That was never 5 viruses!"              !
+----------------------------------------------------------------------------+

gsyme@cix.compulink.co.uk (Gavin Syme) (05/31/91)

In article <10099@suns2.crosfield.co.uk>, imt@crosfield.co.uk (ian taylor) wri-
tes:
>(This is probably only of interest to UK netters, although I believe ST User
>magazine is available internationally by mail order)
>
>Has anyone had problems with this months (June) ST User cover disk?
>I think that there is a free virus included on the coverdisk, which mangled
>the directory of two of my disks before I eradicated it. This is the second
>time that ST User has done this, and frankly I am bloody unimpressed. Anyone
>who's got this disk, beware.
>
>
According to vkiller, there's nothing wrong with the disk. Looks like 
your problems lie elsewhere.

Gavin Syme.

Roger.Sheppard@actrix.gen.nz (Roger Sheppard) (05/31/91)

In article <3100@odin.cs.hw.ac.uk> neil@cs.hw.ac.uk (Neil Forsyth) writes:
> In article <5236@syma.sussex.ac.uk> grahamt@syma.sussex.ac.uk
> (Graham S Thomas) writes:
> >least.  On the cover disk is what they call - several times - the 'very
> >latest version of UniTerm'.  The version is in fact 2.0c. ...
> 
> You'll also find an illegal (very!) copy of NEOchrome on there too.
> About now you'll all be saying "Why does this guy keep going on about
> NEOchrome?". Well the answer is I would like it to be PD officially but Atari
> seem disinterested.
> 
> >Graham Thomas, SPRU, Mantell Building, U of Sussex, Brighton, BN1 9RF, UK
> >Email: grahamt@syma.sussex.ac.uk   Phone: +44 273 678165   Fax: .. 685865
> 
> 
> +----------------------------------------------------------------------------+
> ! DISCLAIMER:Unless otherwise stated, the above comments are entirely my own !
> !                                                                            !
> ! Neil Forsyth                      JANET:  neil@uk.ac.hw.cs                 !
> ! Dept. of Computer Science         ARPA:   neil@cs.hw.ac.uk                 !
> ! Heriot-Watt University            UUCP:   ..!ukc!cs.hw.ac.uk!neil          !
> ! Edinburgh, Scotland, UK           "That was never 5 viruses!"              !
> +----------------------------------------------------------------------------+


I think you will find it is not a illegal copy, its a demo
version, NEOchrome Version 0.5 




-- 
***  Roger W. Sheppard        *    Roger.Sheppard@bbs.actrix.gen.nz  ***
***  85 Donovan Rd          *  *   At least I don't Flicker, not     ***
***  Kapiti New Zealand..    *     like a dying light globe. !       ***

neil@cs.hw.ac.uk (Neil Forsyth) (06/03/91)

In article <1991May31.130524.5964@actrix.gen.nz> Roger.Sheppard@actrix.gen.nz
(Roger Sheppard) writes:
>In article <3100@odin.cs.hw.ac.uk> neil@cs.hw.ac.uk (Neil Forsyth) writes:
>> You'll also find an illegal (very!) copy of NEOchrome on there too.
>> About now you'll all be saying "Why does this guy keep going on about
>> NEOchrome?". Well the answer is I would like it to be PD officially but
>> Atari seem disinterested.
>> 
>
>I think you will find it is not a illegal copy, its a demo
>version, NEOchrome Version 0.5 

It's not version 0.5 that is on the ST User disk.
It's a disassembled/decompiled version 1.0 that has been improved, rebuilt
and called version 2.10 by a hacking group called Chaos.

That's illegal because version 1.0 is not PD and so is taking a copyrighted
program apart.

Now if NEOchrome was made completely PD by Atari then I guess there would
be no problem.

>***  Roger W. Sheppard        *    Roger.Sheppard@bbs.actrix.gen.nz  ***
>***  85 Donovan Rd          *  *   At least I don't Flicker, not     ***
>***  Kapiti New Zealand..    *     like a dying light globe. !       ***

+----------------------------------------------------------------------------+
! DISCLAIMER:Unless otherwise stated, the above comments are entirely my own !
!                                                                            !
! Neil Forsyth                      JANET:  neil@uk.ac.hw.cs                 !
! Dept. of Computer Science         ARPA:   neil@cs.hw.ac.uk                 !
! Heriot-Watt University            UUCP:   ..!ukc!cs.hw.ac.uk!neil          !
! Edinburgh, Scotland, UK           "That was never 5 minutes!"              !
+----------------------------------------------------------------------------+

D.M.Johnson@newcastle.ac.uk (Dave Johnson) (06/03/91)

> In article <5236@syma.sussex.ac.uk> grahamt@syma.sussex.ac.uk
> (Graham S Thomas) writes:
> least.  On the cover disk is what they call - several times - the 'very
> latest version of UniTerm'.  The version is in fact 2.0c. ...
>
> You'll also find an illegal (very!) copy of NEOchrome on there too.
> About now you'll all be saying "Why does this guy keep going on about
> NEOchrome?". Well the answer is I would like it to be PD officially but Atari
> seem disinterested.
>

Actually it's NEochrome Master, and the documentationwith it states that it is
shareware.


Dave

weiner@terminator.cc.umich.edu (Jeff Weiner) (06/03/91)

In article <1991Jun3.104217.6278@newcastle.ac.uk> D.M.Johnson@newcastle.ac.uk (Dave Johnson) writes:
>> In article <5236@syma.sussex.ac.uk> grahamt@syma.sussex.ac.uk
>>
>> You'll also find an illegal (very!) copy of NEOchrome on there too.
>> About now you'll all be saying "Why does this guy keep going on about
>> NEOchrome?". Well the answer is I would like it to be PD officially but Atari
>> seem disinterested.
>>
>
>Actually it's NEochrome Master, and the documentationwith it states that it is
>shareware.
>
>
>Dave

Actually, the word from Bob Brodie at Atari is that it's nothing more than 
an illegal modification of the original neochrome. Thus, you won't find
it here.

weiner
--
Jeff Weiner  --- weiner@{{sklyab,felix}.engin, atari.archive}.umich.edu

sytang@lamar.ColoState.EDU (Shoou-yu tang) (06/04/91)

 Just got a copy from local dealer, the Vkiller 3.84 checked it OK. 
 Also checked the Uniterm that included on disk, here is some result:
 1. Althought the date associated with the included Uniterm were some time in 87.
 While the Uniter2.0E02 from atari.archive has date 86. The file size is bigger
 in 2.0E.
 2. The version # on the Uniterm upon boot up, the atari.archive one shown 2.0E
 and ST USER one shown 2.0C.
 3. Once in the Help menu, pull down the Desk and look for the About ... shows\
 
  2.0E002 for atari.archive one and 2.0C014 for ST USER one.
 So it looks like the 2.0E on the Atari.archive is latest not the ST USER one.

 Tang
 sytang@lamar.colostate.edu

neil@cs.hw.ac.uk (Neil Forsyth) (06/04/91)

In article <1991Jun3.104217.6278@newcastle.ac.uk> D.M.Johnson@newcastle.ac.uk
(Dave Johnson) writes:
> *I* WROTE (WRT to ST User disk):
>> You'll also find an illegal (very!) copy of NEOchrome on there too.
>> About now you'll all be saying "Why does this guy keep going on about
>> NEOchrome?". Well the answer is I would like it to be PD officially but
>>Atari seem disinterested.
>
>Actually it's NEochrome Master, and the documentationwith it states that it is
>shareware.

That's more the opinion of Chaos than fact. The say send the money to Dave
Staugas and put or left an Atari copyright on the program. None of this was
done with Atari's consent and so is illegal. BUT if Atari would like to say
something on NEOchromes future themselves I would be interested to hear it.

+----------------------------------------------------------------------------+
! DISCLAIMER:Unless otherwise stated, the above comments are entirely my own !
!                                                                            !
! Neil Forsyth                      JANET:  neil@uk.ac.hw.cs                 !
! Dept. of Computer Science         ARPA:   neil@cs.hw.ac.uk                 !
! Heriot-Watt University            UUCP:   ..!ukc!cs.hw.ac.uk!neil          !
! Edinburgh, Scotland, UK           "That was never 5 minutes!"              !
+----------------------------------------------------------------------------+