[comp.binaries.ibm.pc] v01i058: Dirty Dozen list 8

W8SDZ@WSMR-SIMTEL20.ARMY.MIL (Keith Petersen) (12/16/88)

Posting-number: Volume 01 Issue 058
Originally-from: Eric Newhouse <no email address>
Submitted-by: Keith Petersen <W8SDZ@WSMR-SIMTEL20.ARMY.MIL>
Archive-name: dirtyd8b/part01

[
This is the April 1988 edition of the famous Dirty Dozen list that was
originally created by Tom Neff (who occasionally posts in
comp.sys.ibm.pc) and later taken over by Eric Newhouse.  It is a fairly
comprehensive list of known harmful or pirated software that has been
seen on bulletin boards.  Please note that for almost every such
program, there is usually a perfectly harmless and useful one by the
same or a similar name.  Don't throw the baby out with the bath water.

As a courtesy to Tom, who favors text postings where appropriate, I'm
posting this in two parts as plain text files.  For BBS use, put into a
file called dd.8 and store that in an archive called dirtyd8b.arc.
Thanks to Keith Petersen, who relayed it here.

CUT BETWEEN CUT LINES AND CONCATENATE BOTH PARTS.  DO NOT UUDECODE. 

checksum     size (bytes)  file (between BEGIN--cut and END--cut lines)
   35595        40648      plain text part01
    8280        38238      plain text part02

-- R.D.
]

part01/02
BEGIN--cut here--cut here

------------------------------------------------------------------
|                                                                |
|       THE DIRTY DOZEN -- An Uploaded Program Alert List        |
|                                                                |
------------------------------------------------------------------
|                                       Issue #8: April 4, 1988  |
|                                                                |
|                                       Revision stage 'B'       |
|                                                                |
|   Maintained by Eric Newhouse                                  |
|   Originally by Tom Neff                                       |
------------------------------------------------------------------


 Recently, many unlawfully copied or modified programs have
appeared on various IBM bulletin boards across the country.
THE DIRTY DOZEN lists known examples.

 The author takes no responsibility for the validity or
completeness of this list.  Many sources contribute to the list,
and it is very possible that one of the reported 'dirty' files
works perfectly and is in the Public Domain.

 Also, users upload bad software to bulletin boards daily, and
often times that bad software is not yet in this list.  In other
words, if you run a trojan horse that is not listed in here,
please don't call my board to complain; rather, leave me a message
so that I can place the destructive program in the next issue.  If
you are unsure whether a file is trojan, and it's not listed in
here, then I recommend using a utility like BOMBSQAD.COM to
prevent any mishaps.  Bombsqad, available on my board, catches
most trojan horses before they can damage your equipment.

 There are five major categories of bad software: commercial
pirate jobs, unauthorized copies of otherwise legitimate freeware
programs, malicious "TROJAN" programs which damage your system,
"VIRII," which damage your and your friends' systems, and
miscellaneous illegal software.  Please look in the definitions
section of this document for a more detailed explanation of these
terms.

 SysOps: Please be careful with the files you post in your
download libraries!  A professional quality program should arouse
your suspicions, especially if it doesn't include the author's
name, address, and distribution policy.  Such programs are
probably NOT public domain!  The BBS community is already under
legislative threat at the State and Federal level.  We cannot
fight this trend effectively while our directories sit stocked
with cracked games, virii, and malicious "trojan horses!"  Let's
demonstrate a little social responsibility by cleaning up our
download libraries.  If you as a SysOp have any of these files on
your system, please delete them and post "blocking" dummy file
entries like this one:


        ZAXXON.COM        DELETED!! NOT PUBLIC DOMAIN!!
                           

 By working together to fight this new brand of software,
perhaps we can eliminate BBS pirates, trojan horse writers,
and legislation aimed at regulating BBS's.
   
 The "Dirty Dozen" aims to bring this important issue to the
attention of more SysOps and users - to act as an information
"clearing-house" for the latest known examples of "bogusware."
Using information gleaned from the Dirty Dozen, an educated public
can fight effectively for safe downloadable files.
     
 The Dirty Dozen needs your help to succeed!  Please call in any
updates of bad software that you know of, but DO NOT modify this
article yourself.  If everyone who discovers a pirated program
starts modifying the DD, there would be hundreds of issues in
circulation.  If you have an update, please see the end of this
article for information on how to reach me with new information.

 In addition, I would like to publicly apologize to Mr. Gerhard
Barth.  In previous issues, I criticized him for distributing a
modified version of the dirty dozen.  Thanks to a few messages
from Karl Brendel, I now know that Gerhard runs a fine well
maintained bulletin board that maintains copies of the true dirty
dozen.  Gerhard, I'm sorry for any hassles I may have caused you.

 One can be sure of only one thing about hard disks, and that is
that they will crash.  Often times a user will blame a program for
a hard disk failure when in fact his problem lies in his/her
hardware.  Remember, a Trojan rumor is much easier to START than
it is to STOP.  Some people have accused legitimate *joke*
programs, such as DRAIN.COM (which pretends to be gurgling excess
water out of your A drive) of erasing their hard drive.  If a
program locks up your system, it isn't necessarily Trojan; it
might not like co-residing with your graphics card or some TSR's.
Ask other users about the program in question before you dennounce
it as Trojan.  Run the program again (on your empty drive) to
confirm its malicious intent.  In short, make 100% sure that the
program is trojan before ruining the author's reputation.  Also, I
would appreciate a bagged specimen of any real Trojan program that
you might have the (un)luck to find.

 A user of mine has notified me that some pirates have patched
HARDHAT.COM and PANGO.COM to read "cracked by Eric Newhouse."
This is ridiculous!  Please disregard any programs that you may
come across in the future advertising "copy protection busted by
Eric Newhouse."  Pirates are simply trying to discourage me
from publishing this list.

 Recently someone asked me why pirates don't rename commercial
files inorder to fool SysOps.  They do!  For example, AUTODEX
circulates under many different names.  Although I will try to
keep all of these names current in the DD, the best way to check
for piracy in a file is to run that file yourself.  Check for
(C)opyright notices of commercial manufactures, similarities in
the cosmetics and operations of commercial programs, and of course
whether the name or filesize is in this list.

  Finally I want to thank all BBS SysOps and users that sent
updates, additions, and/or corrections to DIRTYDOZ.007.  It's
great to see so much support!  In this issue more people than ever
called in with updates.  Everyone else who reads this list, along
with myself, really appreciates the effort!



DEFINITIONS:


    *VIRUS*   (V)   BEWARE!!  Especially prevalent in universities
                   and corporal computers, computer virii can wreak
                   havoc.  They, like biological virii, attack
                   slowly, originating on one computer and
                   proliferating with time.  Virii infect a
                   portion of a computer, usually the operating
                   system.  Most virii modify floppy disks
                   (that may or may not be transported to other
                   computers), adding diabolical code that
                   instruct other computers to replicate the virii
                   for still more computers.  In other words, the
                   floppies become virii themselves; they can be
                   passed around to other people to create more
                   virii.

                    Virii can be programmed to sit dormant for
                   months before acting, just like some biological
                   virii (AIDS comes to mind).  Users can
                   unwittingly replicate a virus many times.  If
                   people know how to spot virii, however, they
                   can usually prevent damage.
                   
                    Virii generally add their code to COMMAND.COM,
                   IBMBIO.COM, or IBMSYS.COM.  These three files,
                   which DOS places on every system disk, are the
                   only files copied to other disks and run on
                   other machines often enough to do any damage.
                   If you see the filesizes on these files change,
                   beware a virus!

                    Your computer provides a small line of defense
                   against Virii already!  IBMBIO.COM and
                   IBMSYS.COM are READ-ONLY files; that is, only a
                   very sophisticated virus can add code to them.
                   COMMAND.COM, however, is NOT read only.
                   Therefore, I advise that EVERYONE make their
                   COMMAND.COM read-only using a utility program
                   such as FILEATTR.COM (available on my board in
                   ARC format), or PC-Tools.  This will give
                   COMMAND.COM some basic protection, and since
                   few people ever write to their command
                   processor, this process should not cause any
                   undue hassles.  Keep in mind, though, that if
                   you ever want to upgrade your version of DOS
                   you will have to change COMMAND.COM back to a
                   regular (not read-only) file.

                    For further information on Virii, everyone may
                   download VIRUS.ARC from my board.



    *TROJAN*  (T)   These programs PURPOSEFULLY damage a user's
                   system upon their invokation.  They almost
                   always will shoot to disable hard disks,
                   although they can destroy other equipment too.
                   It is IMPERATIVE that you let me know about any
                   new examples of these that you find.

                    There are more than one way a TROJAN can
                   disable your hard disk.  For a comprehensive
                   list of examples, please skip to "What to do if
                   you run a trojan horse" later in this document.

    HACKED    (H)   An unlawfully modified copy of an otherwise
                   legitimate public domain or user-supported
                   program.  It is illegal to distribute a
                   modified copy of someone else's work without
                   their permission!  All modified programs must
                   contain this permission, either in the
                   program's display or documentation.

    *CAUTION* (C)   Programs labeled in this manner may or may not
                   be trojans; the question is unresolved.  Use
                   caution when running these programs!

    PIRATED   (P)   This is an illegal copy of a commercial,
                   copyrighted program.  Examples: a cracked
                   (de-protected) game, a compiler, editor or
                   other utility, or a Beta test copy of a program
                   under development.  In the latter case, the
                   program in question may never make it to market
                   due to the piracy!  In the case of games,
                   there's a tendency for the pirate to patch a
                   clumsy "PUBLIC DOMAIN" notice over top of the
                   original copyright.  ZAXXON.COM is a prime
                   example.

    MISC      (M)   This is miscellaneous illegal software and/or
                   text.  The best definition, aside from that,
                   that I can think of is that it's NOT pirated
                   software.


NOTE: If I do not supply a file extension, that means that the
file circulates under many different extensions.  For instance,
users commonly upload with extensions of either:  .EXE, .COM,
.EQE, .CQM, .LBR, .LQR, and .ARC.


------------------------------------------------------------------
|                             VIRII                              |
------------------------------------------------------------------


Name          Size Category  Notes
------------- ------  -  -----------------------------------------

CHRISTMAS.EXEC   ???  V   This is the famous Bitnet virus.  Around
                         Christmas time, this program sent mail to
                         every bitnet user with a defined "nickname"
                         (Bitnet users use short nicknames to
                         avoid typing long user ID's) with a
                         picture of a christmas tree.  The mail
                         eventually reached so many people that it
                         overloaded the system, creating a lot of
                         yuletide headaches.

                          PC Users do not need to worry about the
                         Bitnet virus.  The program is written in
                         REXX, a mainframe only language, and it
                         can only run on mainframes that use
                         Bitnet's nickname technique.  This entry,
                         in fact, is here primarily to help clear
                         up the confusion prevalent when talking
                         about this virus.

*.EXE, *.COM   ANY    V   Any of your executable files may
                         contain a virus in it.  Don't Panic,
                         though; this virus is detectable!  If you
                         have an infected file, it will increase
                         the size of all other .EXE files run
                         thereafter by 1808 bytes and all .COM
                         files by 1813 bytes upon invocation.

                          Now you know how to recognize this
                         virus.  Be sure to look out for it,
                         because the symptoms it creates are very
                         nasty.  The virus increases the size
                         of .EXE files repeatedly - not just once.
                         While this is a boon in recognizing the
                         virus, it also means that eventually all
                         affected .EXE files will become to large
                         to fit in memory.  The virus also slows
                         down computers by as much as 500% after
                         it has spread.  Watch for this symptom!
                         Perhaps most deadly, on any Friday the
                         13th, this virus will erase AT LEAST all
                         .EXE and .COM files that you run, and AT
                         WORST your whole disk.  The next Friday
                         the 13th is May 13, 1988.

COMMAND.COM    ?????  V   This is a traditional Virus.  Originating
                         in colleges and universities accross the
                         nation, this virus will embed itself in
                         COMMAND.COM.  Once there it will copy
                         itself onto FOUR floppies before
                         scrambling your FAT and initiating a
                         format.  Beware!  In one known instance,
                         the virus does NOT change the filesize
                         of COMMAND.COM, but it does change
                         the date.

QMDM31B.ARC   ??????  V   The latest official release of Qmodem,
                         as of this writing, is 3.1a.  This
                         version, which is less than 1 KB bigger
                         than the Archive for 3.1a, will add 17
                         bytes to your IBMBIO.COM file.  Beware;
                         while I don't know how this virus works,
                         I do know that there's NEVER any reason
                         to add 17 bytes to IBMBIO.COM.
                           Note: IBMBIO.COM is a READONLY file.
                         In other words, here is the first trojan
                         that can write past a "write protect;"
                         this virus acts when it theoretically
                         shouldn't be able to.

------------------------------------------------------------------
|                        TROJAN HORSE PROGRAMS:                  |
------------------------------------------------------------------


Name          Size Category  Notes
------------- ------  -  -----------------------------------------

123JOKE               T   This so-called utility for Lotus 123
                         rewrites [hard] disk directories.

ANTI-PCB              T   The story behind this trojan horse is
                         sickening.  Apparently one RBBS-PC sysop
                         and one PC-BOARD sysop started feuding
                         about which BBS system is better, and in
                         the end the PC-BOARD sysop wrote a trojan
                         and uploaded it to the rbbs SysOp under
                         ANTI-PCB.COM.  Of course the RBBS-PC
                         SysOp ran it, and that led to quite a few
                         accusations and a big mess in general.
                         Let's grow up!  Every SysOp has the right
                         to run the type of BBS that they please,
                         and the fact that a SysOp actually wrote
                         a trojan intended for another simply
                         blows my mind.

ALTCTRL.ARC           T   This program reputedly trashes boot
                         records.  Other than that, I know nothing
                         about it.

ARC513.EXE            T   This hacked version of SEA's ARC.EXE
                         appears normal.  However, it writes
                         over track 0 of your [hard] disk upon
                         usage, destroying the disk's boot sector.

ARC514.COM            T   This is completely similar to arc
                         version 5.13 in that it will overwrite
                         track 0 (boot sector) of your hard disk.
                         Also, I have yet to see an .EXE version
                         of this program..

BACKALLY.COM   64512  T   This sophisticated trojan will axe your
                         FAT table after a couple of months of
                         usage.  Beware the delayed trojan!
                         Backally MAY only work on floppy disks,
                         but that sounds unlikely.  Debug has
                         shown that BACKALLY formats a track at
                         one point as well as reading in the
                         amount of freespace on your disk.  It may
                         only wipe out full disks, like NOTROJ.
                         Please, be wary!  An included .BAT file
                         comes with a request for donations to
                         "SomeWare" located in Frederickburg, VA.
                         Look out for other products from
                         SomeWare!

BACKTALK              T   This once beneficial utility will
                         write/destroy sectors on your [hard] disk
                         drive.  Use this with caution if you
                         acquire it, because it's more than likely
                         that you got a bad copy.

BXD.ARC        20480  T   This disk killer warns users that "your
                         disk will be trashed in 5 seconds" on
                         sector 17 on the included BXD.COM file.
                         Watch out for this FAT killer!

CDIR.COM              T   This program supposedly gives you a
                         color directory of files on disk, but it
                         in fact scrambles your disks FAT
                         table.

CHUNKER.EXE           TC  A part of QEDIT v. 2.02, this program
                         writes five apparently harmless files to
                         disk.  Chunker, which is supposed to
                         split large text files into more
                         manageable, smaller ones, may also
                         scramble FAT's.

COMPRESS.ARC          T   This trojan, dated April 1, 1987,
                         destroys FAT tables.  COMPRESS is
                         executed from a file named RUN-ME.BAT and
                         is advertised as a 'Shareware 'ARC' from
                         Borland!'

DANCERS.BAS           T   This trojan shows some animated dancers
                         in color, and then proceeds to wipe out
                         your [hard] disk's FAT table.  There is
                         another perfectly good copy of
                         DANCERS.BAS on BBS's around the country;
                         apparently the author altered a
                         legitimate program to do his dirty work.

DEFENDER.ARC          T   This trojan both writes to ROM bios and
                         formats [hard] disks.  The Duplicators
                         claim credit for this trojan; be ware of
                         other products by them.  Also, do not
                         confuse this trojan with DEFENDER by
                         Atari.  The latter is a pirated program.

DISCACHE.EXE          TC  This program uses direct BIOS routines
                         to write to disk.  Apparently, those BIOS
                         routines will scramble your FAT table.
                         Please see DISCACHE.WNG, a file that I'm
                         looking for myself, for more information.
                         There is at least one legitimate
                         DISCACHE.EXE file circulating, so
                         not all DISCACHE programs are trojan.

DISKSCAN.EXE          T   This was a PC Magazine program to scan a
                         [hard] disk for bad sectors, but then a
                         joker edited it to WRITE bad sectors.
                         Also look for this under other names such
                         as SCANBAD.EXE and BADDISK.EXE...

DMASTER               T   This is yet another FAT scrambler..

DOSKNOWS.EXE   6144   TC  I'm still tracking this one down --
                         apparently someone wrote a FAT killer and
                         renamed it DOSKNOWS.EXE, so it would be
                         confused with the real, harmless DOSKNOWS
                         system-status utility.  I'm pretty sure
                         that sure is that the REAL DOSKNOWS.EXE
                         is 5376 bytes long.  If you see something
                         called DOSKNOWS that isn't close to that
                         size, sound the alarm.  More info on this
                         one is welcomed -- a bagged specimen
                         especially.  The malicious DOSKNOWS
                         contains the string: "Ouch!  Dos refused
                         to tell me! Sob, sob, sob."  Be careful;
                         there may be a legitimate 6144 byte
                         DOSKNOWS floating around too.

DPROTECT              T   Apparently someone tampered with the
                         original, legitimate version of DPROTECT
                         and turned it into a FAT table eater.

DROID.EXE     54272   T   This trojan appears under the guise of a
                         game.  You are supposably an architech
                         that controls futuristic droids in search
                         of relics.  In fact, the program copies
                         C:\PCBOARD\PCBOARD.DAT to
                         C:\PCBOARD\HELP\HLPX if PC-Board SysOps
                         run it from C:\PCBOARD
                         
EGABTR                T   BEWARE! Description says something like
                         "improve your EGA display," but when run
                         it deletes everything in sight and prints
                         "Arf! Arf!  Got you!"

ELEVATOR.ARC          T   This poorly written trojan suggests in
                         the documentation that you run it on a
                         floppy.  If you do not run it on a
                         floppy, Elevator chastises you for not
                         reading the documentation.  Regardless of
                         what disk you run it on, Elevator will
                         erase your files.  It MAY format disks
                         too; be careful.  One more interesting
                         point to note: my name is plastered all
                         over this program; the writers attempt to
                         lay the blame for this trojan on me.

EMMCACHE  ????        T   This program is not exactly a trojan,
V. 1.0                   but it may havethe capability of
                         destroying hard disks by:
                           A) Scrambling every file modified after
                               running the program,
                           B) Destroying boot sectors.
                          This program has damaged at least two
                          hard disks, yet there is a base of
                          happily registered users.  Therefore, I
                          advise extreme caution if you decide to
                          use this program.

FILER.EXE             T   One SysOp complained a while ago that
                         this program wiped out his 20 Megabyte
                         HD.  I'm not so sure that he was correct
                         and/or telling the truth any more.  I
                         have personally tested an excellent file
                         manager also named FILER.EXE, and it
                         worked perfectly. Also, many other
                         SysOp's have written to tell me that they
                         have like me used a FILER.EXE with no
                         problems.  If you get a program named
                         FILER.EXE, it is probably allright, but
                         better to test it first using some
                         security measures.

FINANCE4.ARC  ??????  TC  This program is not a verified trojan,
                         but there is a file going around BBS's
                         warning that it may be trojan.  In any
                         case, execute extreme care with it.

FUTURE.BAS            T   This "program" starts out with a very
                         nice color picture (of what I don't know)
                         and then proceeds to tell you that you
                         should be using your computer for better
                         things than games and graphics.  After
                         making that point it trashes your all of
                         your disk drives, starting with disk A:.
                         Not only does Future scramble FATs, but
                         it also erases files.  As far as I know,
                         however, it erases only one sub-directory
                         tree level deep, thus hard disk users
                         should only be seriously affected if they
                         are in the "root" directory.  More
                         information about this is especially
                         welcome.
                         
MAP                   T   This is another trojan horse written by
                         the infamous Dorn W. Stickle.  I believe
                         that there are legitimate MAP.EXEs
                         floating around.

NOTROJ.COM            T   This "program" is the most sophisticated
                         trojan horse that I've seen to date.  All
                         outward appearances indicate that the
                         program is a useful utility used to FIGHT
                         other trojan horses.  Actually, it is a
                         time bomb that erases any hard disk FAT
                         table that IT can find, and at the same
                         time it warns: "another program is
                         attempting a format, can't abort!"  After
                         erasing the FAT(s), NOTROJ then proceeds
                         to start a low level format.  One extra
                         thing to note: NOTROJ only damages FULL
                         hard drives; if a hard disk is under 50%
                         filled, this program won't touch it!  If
                         you are interested in reading a thorough
                         report on NOTROJ.COM, James H. Coombes
                         has written an excellent text file on the
                         matter named NOTROJ.TXT.  If you have
                         trouble finding it, you can get it from
                         my board.

TIRED                 T   Another scramble the FAT trojan by Dorn
                         W.  Stickle.

TSRMAP                T   This program does what it's supposed to
                         do: give a map outlining the location (in
                         RAM) of all TSR programs, but it also
                         erases the boot sector of drive "C:".

PACKDIR               T   This utility is supposed to "pack" (sort
                         and optimize) the files on a [hard] disk,
                         but apparently it scrambles FAT tables.

PCLOCK                TC  This program reputedly destroys FAT
                         tables!  Be careful!  Also, please bear
                         in mind that there are more than one
                         PCLOCK programs in circulation, so please
                         don't confuse the trojan program with a
                         legitimate one.  Simply excercise EXTREME
                         caution when running a NEW PCLOCK
                         program.

PCW271xx.ARC          T   A modified version of the popular
                         PC-WRITE word processor (v. 2.71) has now
                         scrambled at least 10 FAT tables that I
                         know of.  If you want to download
                         version 2.71 of PC-WRITE be very careful!
                         The bogus version can be identified by
                         its size; it uses 98,274 bytes wheras the
                         good version uses 98,644.  For reference,
                         version 2.7 of PC-WRITE occupies 98,242
                         bytes.

PKX35B35.EXE          T   As of this writing, Phil Katz (author of
                          PKXARC) has verified that version 35A35
                          is the latest version of his ARChive
                          extractor.  This phony PKXARC scrambles
                          FAT tables.

QUIKRBBS.COM          T   This Trojan horse claims that it can
                         load RBBS-PC's message file into memory
                         200% faster than normal.  What it really
                         does is copy RBBS-PC.DEF into an ASCII
                         file named HISCORES.DAT...

QUIKREF               T   Little is known about this trojan, other
                         than it scrambles FATS
                            
RCKVIDEO              T   This is another trojan that does what
                         it's supposed to do, then wipes out hard
                         disks.  After showing some simple
                         animation of a rock star ("Madonna," I
                         think), the program erases every file it
                         can lay it's hands on.  After about a
                         minute of this, it will create 3 ascii
                         files that say "You are stupid to
                         download a video about rock stars," or
                         something of the like.

SCRNSAVE.COM          TC  I know nothing about this program, but a
                         user of mine reports that it erases HD's.

SECRET.BAS            T   BEWARE!! This may be posted with a note
                         saying it doesn't seem to work, and would
                         someone please try it.  If you do try it,
                         however, it will format your disks.

SEX-SNOW.ARC          T   This trojan deletes all of the files
                         in your directory and creates a gloating
                         message using those filenames.  Ugly.

SIDEWAYS.COM          T   Be careful with this trojan; there is a
                         perfectly legitimate version of
                         SIDEWAYS.EXE circulating. Both the trojan
                         and the good SIDEWAYS advertise that they
                         can print sideways, but SIDEWAYS.COM will
                         trash a [hard] disk's boot sector
                         instead.  The trojan .COM file is about 3
                         KB, whereas the legitimate .EXE file is
                         about 30 KB large.

STAR.EXE              T   Beware RBBS-PC SysOps!  This file puts
                         some stars on the screen while copying
                         RBBS-PC.DEF to another name that can be
                         downloaded later!

STRIPES.EXE           T   Similar to STAR.EXE, this one draws an
                         American flag (nice touch), while it's
                         busy copying your RBBS-PC.DEF to another
                         file (STRIPES.BQS) so Bozo can log in
                         later, download STRIPES.BQS, and steal
                         all your passwords.  Nice, huh!

SUG.ARC               T   Words can not express my feelings about
                         this trojan.  SUG.ARC advertises that it
                         can break SOFTGUARD copy protection, but
                         upon invocation, it will scramble the
                         FAT's on drive A, B, C, and onwards to
                         your higest drive.  While this is
                         certainly a nasty trojan, it is
                         particularly repulsive because Softguard
                         Corp, the creators of Softguard
                         copy-protection, wrote it - perhaps in
                         response to declining business.  They
                         claim that anyone who runs SUG is
                         breaking an original license agreement;
                         therefore they may legally destroy data.
                         I don't credit this, and neither does an
                         attorney I know, so I eagerly anticipate
                         Softguard's day in court.

TOPDOS                T   This is a simple high level [hard] disk
                         formatter.  Do not confuse this with the
                         pirated TOPDOS.COM.

VDIR.COM              T   This is a disk killer that Jerry
                         Pournelle wrote about in BYTE Magazine.
                         I have never seen it, but two users of
                         mine have.

VISIWORD.ARC          TC  A user of mine called this trojan in
                         complaining that it destroyed his hard
                         disk.  Other than that, I know nothing
                         about this program.

WARDIAL1.ARC          TC  This Wardialer may scramble FAT tables


------------------------------------------------------------------
|                        HACKED PROGRAMS:                        |
------------------------------------------------------------------
|                                                                |
|             '*' = not verified by program's author             |
|                                                                |
------------------------------------------------------------------



ARC.COM               H   Someone keeps running SPACEMAKER or a
                         similar EXE squeezer on SEA, Inc.'s ARC
                         archive program, then uploading the
                         resulting COM file to BBS's without the
                         author's permission.  SEA will NOT
                         support the COM version, for they
                         definately do not allow modifying ARC.EXE
                         in their license agreement.

AUTOMAXX.ARC          C   This DOS menu-making program comes with
                         documentation that Marshall Magee, author
                         of the popular AUTOMENU program, contends
                         is plagiarized.  Marshall believes that
                         the AUTOMAXX documentation uses exact
                         phrases from his documentation, and if
                         this is the case, AUTOMAXX is clearly
                         illegal.  However, as I understand it,
                         the courts are currently deliberating on
                         the case, so AUTOMAXX is not currently
                         illegal. of today.  For more information,
                         please contact Marshall Magee at (404)
                         446-6611.

DOG101A.COM   *       C   This may be hacked; keep an eye out
                         for it as well as DOG102A.COM.

DOG102A.COM   *       H   Apparently this is a renamed early
                         version of DP102A.ARC, a disk optimizer.
                         One person has reports that it trashes
                         hard disks that use DOS 3.1 (2KB
                         clusters).

LIST60                H   Vern Buerg's LIST 5.1, patched to read
                         6.0.  Mr. Buerg has released a legitimate
                         version 6.0 of LIST.  Every legit.
                         version will have a letter in the
                         filename (e.g. LIST60H.ARC)

LIST799               H   Vern Buerg's LIST 5.1, patched to read
                         7.99.

QMDM110.ARC           H   This is version 1.09 of Qmodem patched
                         to read 1.10.  There have been rumors of
                         a worm in 1.10, but I have seen no
                         evidence of it.  Other versions are OK.


------------------------------------------------------------------
|                       PIRATED PROGRAMS:                        |
|                                                                |
|                                                                |
| TYPES:                                                         |
|       Game (G) -- Recreational Software, usually high Quality  |
|       Util (U) -- a disk, screen, or general utility           |
|       Misc (M) -- Miscellaneous (not a game or utility)        |
------------------------------------------------------------------


 Note:  While close to 98%-99% of BBS's that I've seen do NOT
distribute pirated files, the small minority that do slander the
reputations of honest SysOp's nationwide.  Unfortunately, 1%-2% of
thousands of BBS's is a sizable number.  Over the last couple of
years this 1%-2% has distributed so many files that even the most
conscientious SysOp can hardly hope to recognize all commercial
software.

 You may ask: "How can we fight piracy, then?"

 SysOp's and users alike must search ALL programs for signals 
that can reveal a program as commercial.  Look for Copyright
signs.  Suspect good games with sparse if any documentation.  If
you notice that a program is pirated, calmly inform your local
SysOp's of the menace.  In order to beat piracy, we must
communicate!

Name          Size Category  Notes
------------- ------  -- -----------------------------------------

1DIR.COM              PU  "The ONE Dir": DOS shell.
21C.EXE               PG  Blackjack, copyright by IBM
3DCHESS               PG  Psion's 3D Chess program
400KDISK.ARC    8192  PU  Qdrive by Tall Tree Systems: allows
                         floppy disks to be formatted to 400 KB.
ACUPAINT.ARC  148221  PM  PC Paint
AFOX.ARC              PG  Artic Fox by Electronic Arts
ALLEYCAT.COM          PU  "Alley Cat" - CGA
ALTEREGO.ARC  45????  PG  Alter Ego game from Activision
ARCHON.COM            PG  Electronic Art's Archon.
ARTOFWAR              PG  Ancient Art of War by Broderbund
AUTODEX               PU  AUTODEX, file manager
AXX.EXE               PU  Also AUTODEX
B1-BOMB               PG  Avalon Hill's B1 Bomber
BATTLE                PG  Battle Zone 
BBCHESS               PG  Blues Box Chess
BC-QUEST              PG  Bc's Quest for Tires
BIGMAC.ARC            PU  Borland's Superkey
BORDERZO.ARC  205824  PG  Infocom's Borderzone
BORROWED.ARC          PG  Borrowed Time
BRUCELEE              PG  Bruce Lee 
BUCK                  PG  Buck Rogers on Planet Zoom
BURGER                PG  Burgertime
BUSHIDO               PG  Karate Game by a manufacturer in Canada.
BUZZBAIT              PG  Buzzard Bait
CALL2ARM              PG  Call to Arms
END--cut here--cut here