[comp.binaries.ibm.pc.d] NetHack 3.0j: file sizes wrong, virus?

gordon@osiris.cso.uiuc.edu (John Gordon) (05/22/91)

	Well, I got all the parts of the NetHack 3.0j post, and un-zoo'd it
on my PC.  However, both of the .zoo files are 37 bytes bigger than the
sizes given in the header of the first part, and "sum" reports different
figures as well.  The individual file sizes are correct, though.  I do not
have brik do I did not test it that way.  Any comments/suggestions?  Could
there be a virus?

---
John Gordon
Internet: gordon@osiris.cso.uiuc.edu        #include <disclaimer.h>
          gordon@cerl.cecer.army.mil       #include <clever_saying.h>

clb@hp835.mitek.com (Chris Boyd) (05/23/91)

In article <1991May22.153246.6351@ux1.cso.uiuc.edu> gordon@osiris.cso.uiuc.edu (John Gordon) writes:
>	Well, I got all the parts of the NetHack 3.0j post, and un-zoo'd it
>on my PC.  However, both of the .zoo files are 37 bytes bigger than the
>sizes given in the header of the first part, and "sum" reports different
>figures as well.  The individual file sizes are correct, though.  I do not
>have brik do I did not test it that way.  Any comments/suggestions?  Could
>there be a virus?
>John Gordon
>Internet: gordon@osiris.cso.uiuc.edu        #include <disclaimer.h>
>          gordon@cerl.cecer.army.mil       #include <clever_saying.h>

I too noted the difference.  Brik checksums were off as well.  I checked the
zoo'ed binaries with the -t option and everything seemed O.K.  I then
extracted the files and scanned them with F-PROT's F-SCAN and McAfee's
SCAN (no, not 78 :-).  Both programs reported a clean machine.  The game
seems to run fine.

Anyone asked the authors yet?
-- 
(*---------------------------------------------------------------------------*)
(* Chris Boyd          OpenConnect Systems, Inc.          clb@mips.mitek.com *)
(*               All rights regarding my opinions reserved.                  *)
(*          I have no right to speak for others, only for myself.            *)

pcampb@brahma.trl.OZ.AU (Peter Campbell) (05/23/91)

clb@hp835.mitek.com (Chris Boyd) writes:

>In article <1991May22.153246.6351@ux1.cso.uiuc.edu> gordon@osiris.cso.uiuc.edu (John Gordon) writes:
>>	Well, I got all the parts of the NetHack 3.0j post, and un-zoo'd it
>>on my PC.  However, both of the .zoo files are 37 bytes bigger than the
>>sizes given in the header of the first part, and "sum" reports different
>>figures as well.  The individual file sizes are correct, though.  I do not
>>have brik do I did not test it that way.  Any comments/suggestions?  Could
>>there be a virus?

>I too noted the difference.  Brik checksums were off as well.  I checked the
>zoo'ed binaries with the -t option and everything seemed O.K.  I then
>extracted the files and scanned them with F-PROT's F-SCAN and McAfee's
>SCAN (no, not 78 :-).  Both programs reported a clean machine.  The game
>seems to run fine.

I got the checksum error when trying to unzoo them, but it gave me a
line number to check (zoo for pc - very handy for multipart archives).
The trouble is that one line got split over two.  To fix this you just
have to edit the file at that line (I think it was about line 430 in
part 6 in the #2 archive - I had no problem with #1), removing the line
feed/cr.  I don't think that the programs will run correctly if you
don't do this - it will work most of the time, but when it gets to a
certain part of the code (e.g. getting the artifact ...) it may crash.
I'm not totally sure about this, but I'd make the alteration if I were
you.

Peter K. Campbell
aka Purple

desimone@cse.uta.edu (David DeSimone) (05/23/91)

In article <1991May22.153246.6351@ux1.cso.uiuc.edu> gordon@osiris.cso.uiuc.edu (John Gordon) writes:
>	Well, I got all the parts of the NetHack 3.0j post, and un-zoo'd it
>on my PC.  However, both of the .zoo files are 37 bytes bigger than the
>sizes given in the header of the first part, and "sum" reports different
>figures as well.

Do you suppose that the file might have been downloaded with Xmodem or
Ymodem, and that it may have been padded with extra data because of
that?

-- 
David DeSimone, aka "Fuzzy Fox" on some networks.          /!/!
INET:    an207@cleveland.freenet.edu                      /  ..
Q-Link:  Fuzzy Fox                                        /   --*
Quote:   "Foxes are people too!  And vice versa."         /  ---

norm@cfctech.cfc.com (Norman J. Meluch) (05/23/91)

In article <1991May22.153246.6351@ux1.cso.uiuc.edu>
gordon@osiris.cso.uiuc.edu (John Gordon) writes:
{G}	Well, I got all the parts of the NetHack 3.0j post, and un-zoo'd it
{G} on my PC.  However, both of the .zoo files are 37 bytes bigger than the
{G} sizes given in the header of the first part, and "sum" reports different
{G} figures as well.

That's odd.

{G} The individual file sizes are correct, though.  I do not
{G} have brik do I did not test it that way.  Any comments/suggestions?  Could
{G} there be a virus?

There could, but I doubt it.  The c.b.i.p moderator is *awful* careful
about such things.

clb@hp835.mitek.com (Chris Boyd) writes:
{C} I too noted the difference.  Brik checksums were off as well.

Well when the file size differs, I'd expect so.

{C} I then extracted the files and scanned them with F-PROT's F-SCAN and
{C} McAfee's SCAN (no, not 78 :-).  Both programs reported a clean machine.
{C} The game seems to run fine.

As did I, and (I'm sure) as did Mr. Davidsen.

{C} Anyone asked the authors yet?

Ok here's MHO.

Comparing the uudecoded zoo files to the copies I have (of the ones I
submitted) I note that there is now a comment of
	">> Nethack game v3.0.10, disk one files"
added to the first archive and one that says
	">> Nethack game v3.0.10, disk two files"
added to the second.

I can only expect that these were added by Mr. Davidsen (or some other
reviewer), but since these were not in the zoo files I submitted
I could not anticipate them in the checksums that I submitted with
it.  (note there is a typo in the full listing zoo CRC for GUIDEBK.TXT
is "a723" not "s723" :-)

Note also that only the complete archive zoo CRC and brik checksums are
off.  The others listed (verified by zoo vC <archive.zoo>) are correct.

No.  I don't think we have any troubles here.

Hack On!

						- Norm.
-- 
|~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Norman J. Meluch ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|
| Mail: norm@cfctech.cfc.com           Fax:(313)948-4975  Voice:(313)948-4809 |
| Note: The opinions expressed here are in no way to be confused with valid   |
|_______ideas or corporate policy.____________________________________________|