[comp.binaries.ibm.pc] FLUSHOT Trojan Alert from Ross Greenberg

leefi@microsoft.UUCP (Lee Fisher) (03/11/88)

Hello 'net:

Once again, I'm posting a message from Ross Greenberg (author of the
FLUSHOT program) since he doesn't have usenet access. I believe this
is in all uppercase because Ross is "shouting"...

Yes, Yet Another "trojan" warning... sigh.

-Lee
________
01001100  Lee Fisher, Microsoft Corp., Redmond, WA.
01000101  {uw-beaver,decvax,decwrl,trsvax,sun,attunix,uunet}!microsof!leefi 
01000101  leefi@microsof.uucp
01000110  leefi@microsof.beaver.washington.edu
01001001  disclaimer: My opinions are my own, not those of my employer.


---- snip here ----- snip here ----- snip here ----- snip here ----- 

From Ross M. Greenberg, BIX/MCIMAIL=GREENBER, RAMNET=212-889-6438:

=============================================================================
                        !!OF VITAL IMPORTANCE!!
=============================================================================

ATTENTION!
==========

THERE IS A TROJAN PROGRAM AFOOT AND IT'S CALL FLU4TXT.COM!

IT DID NOT ORIGINATE FROM MY BOARD, OBVIOUSLY. AS OF 3/11/88 THE MOST
RECENT RELEASE OF THE FLUSHOT PROGRAM IS 'FLUSHOT3'.  THE ARCHIVE CONTAINS
A NUMBER OF TEXT FILES, AND FLUSHOT3.COM ITSELF. LEGITIMATE COPIES OF
FLUSHOT3 ARE AVAILABLE ON EITHER OF THE BBS'S BELOW, ON GENIE, ON BIX, OR
FROM USENET.

ABOUT THE TROJAN
================

FLU4TXT.COM IS A TEXT DISPLAY PROGRAM WHICH WILL SHOW YOU SOME OF THE
DOCUMENTATION WHICH COMES WITH FLUSHOT3, AND WILL THEN DAMAGE YOUR HARD
DISK WHEN YOU EXIT.  ADDITIONALLY, IT ALSO PLAYS GAMES WITH THE DISK
PARAMETER TABLE.  NASTY STUFF.

THE WRITER OF THE TROJAN WAS CLEVER: IT IS SELF MODIFYING AND SELF
RELOCATING CODE WHICH WILL NOT BE FOUND BY CHK4BOMB.

WHAT TO DO
==========

PLEASE BE SURE TO TELL ANY SYSOP ON ANY BOARD WHERE YOU SEE THIS PROGRAM
(OR AN ARCHIVE CALLED FLUSHOT4) THAT IT IS A TROJAN, THAT IT SHOULD BE
REMOVED FROM THEIR BOARD IMMEDIATELY, AND THAT A WARNING MESSAGE SHOULD BE
POSTED TO THAT EFFECT.  PERHAPS A COPY OF THIS WARNING BULLETIN WILL
SUFFICE.

!!!DO NOT RUN FLU4TXT.COM!!! IT WILL EAT YOUR HARD DISK *AS*IT*EXITS*!!!

WHO DO I CONTACT?
=================

IF YOU HAVE QUESTIONS ABOUT FLU4TXT.COM OR ABOUT THE LEGITIMATE SERIES OF 
FLUSHOT PROGRAMS, PLEASE FEEL FREE TO LEAVE A MESSAGE ON FOR ME ON EITHER
OF THE FOLLOWING BBS SYSTEMS:

    RAMNET ((212)-889-6438), NYACC ((718)-539-3338)

OR ON 'BIX' OR VIA 'MCI MAIL' (I'M USER 'GREENBER' ON BOTH BIX AND MCI)

FLUSHOT3.ARC IS AVAILABLE ON THOSE BULLETIN BOARDS AS WELL AS MANY AROUND
YOU.  BEFORE DOWNLOADING A COPY FROM A TRUSTED BBS, PLEASE BE SURE TO ASK
THE SYSOP IF THEY HAVE ACTUALLY RUN THE COPY THEY HAVE AVAILABLE FOR
DOWNLOAD ON THEIR BOARD.  IT IS *YOUR* DISK AT RISK.....

                             ROSS M. GREENBERG
=============================================================================