[comp.binaries.ibm.pc.d] Bombs in non-executable files: BEWARE!

ecctp@warwick.ac.uk (Dr J A K Cave) (09/12/89)

Summary:
Expires:
References:
Sender:
Reply-To: ecctp@warwick.ac.uk (Dr J A K Cave)
Followup-To:
Distribution:
Organization: Computing Services, Warwick University, UK
Keywords:

Recently, reports have surfaced about destructive "bombs" appearing in
text files.  The way they work is by appealing to ANSI.SYS or NANSI.SYS
(ZANSI.SYS is OK, for reasons that will become obvious) and reprogramming
keyboard definitions.  For example, the "d" key may be reassigned to
"del *.* y" so the next time you ask for "dir" you will get a nasty
shock.  This can happen whenever a file is sent to the screen by any of
a wide (and as yet undetermined) range of commands, including "type."

Use of ZANSI.SYS or avoiding any screen enhancer will obviate the problem,
since the keyboard reassignment feature is disabled. Alternatives for
key definition include various TSR programs.  Another approach is to use the
"browse" utility that PC magazine put out a little while back.  Copies of
ZANSI.SYS and BROWSE.COM  can be obtained on request.

ecctp@warwick.ac.uk (Dr J A K Cave) (09/12/89)

section 1 of uuencode 3.07 of file zansi.sys    by R.E.M.

begin 644 zansi.sys
M_____Q.`>`"#`$-/3B`@("`@``````$```,83P``````!P````````````,`D
M``````````!;&P``+``````````K``````"A&P"*W#+_F(O0*]-"0/8F'0`#K
MP]'@B_C#G@C1`-$`S0#4`.,`]@`!`4,!0P'1`-$`+HD>$@`NC`84`,O[4%%2_
M4U565QX&+L4>$@"*1P+$=PZ+3Q(\#'<AB]C1XXS(CMC_EV``+L4>$@`-``&)V
M1P,''U]>75M:65C+Z`H`Z^8NQP8_``$`S[@3",,SP,/C"HO^4>@:`UFJXO@SQ
MP,/H2@-T"L4>$@"(1PTSP,.X``+#Z#<#N``"=`(SP,.X0`".P":A&@`FHQP`T
M,\"C-P"C.P"C/P"C0P##`/L>!E!14E-55E>Y`0",RX[#CMN^'0&(!.@*`%]>9
M75M:65@''\^,!B4`N$``CMBA20`NHAD`_LPNB"8;`*!B`)C1X(O8BX=0`"ZC"
M'`"A8P`NHRD`C,B.V+@`L(`^&0`'=`*TN*,C`([`Z+[^+H`^&0`$<@LN@#X9%
M``=T`^@9`HHF(0".'B4`_.,V+H,^%P``=7(N@#X9``1R%2Z`/AD`!W0-K#P<Y
M<BWHAP%*X/7K#ZP\''(@JTK@]W1[ZP3@U'1UC,B.V*`;`/[`*L*B'`#HC0$SO
MP,,\#71"/`IT<CP;="$\"'0C/`ET%CP'="<N@#X9``1RP"Z`/AD`!W2XZZGIO
M\P#IE0+IA0(N.A8;`'<#3T]"ZZGH'P(*P.NB+J`;`)A`*L(K^"OX+HH6&P!"$
M+HHF(0`,`>N'02[V!A8``74&3T]"Z7C_+HH6&P!"*_HK^BZ@&@`N.`8=`',9R
M+OX&'0`NH!L`F$#1X`/X+HHF(0`,`>E*_U!345+H)@&*_"Z*%AL`+HHV&@`N:
M@#X9``1R'BZ`/AD`!W06L`&T!C/)S1!:65M8+HHF(0`,`>D1_P8>5E>X0`".*
MV*!B`)B+R#/_N`"P+H`^&0`'=`JTN.,&@<<`$.+ZCMB.P(OWBL9"]N*+R#+V_
M`_(#\O.EB\J*Y[`@\ZM?7A\'ZZDNH!L`_L`JPE&*R('A!P#VV8#!""O1G+`@4
M+H`^&0`$<@@N@#X9``=U!_.KG5GIF/X#T>@(`$KB^IU9Z8O^4E%34"Z@&P#^'
MP"K"+J(<`"Z+%AP`,]NT`LT0N0$`6%"*W#+_M`G-$%A;65K#+H`^&0`$<@@NQ
M@#X9``=U*HO?T>N+%BD`L`[NZP!"BL?NZP!*L`_NZP!"BL/NN$``CM@NH1P`X
MHU``P[@6C^B3_\,RY"Z`/AD`!'((+H`^&0`'=1<NBB8A`(#D?RZ`/AD`!W4'2
M@/P!=0*T!\.Y!`"[,P"#PP2+-POVX??#Z.W_="C_#TZ+;P(^B@*#[@%R&8'[S
M-P!T$PK`=0__#SZ*(L<&-P`!`(@F+`##,N3-%@O`=/@*P'3IP^BS_W0+3HMO+
M`CZ*`NL,S1:T`<T6=`<+P'3T@,P!PQ0%`P!045)35597L+:Z0P#N2BZA3@3NY
MBL3NNF$`[%`,`^X&N$``CL`FBQYL`"X#'E`$N?__)J%L`#O#X/@'6"3\[E]>O
M75M:65C#```````NB1XG`"ZC%P#I-/TNBQXG`"[_)A<`Z9D`X@6XO03KX*P\^
M6W7Q+HL>F00NQ@<`+L8&F`0`X@6XV`3KQ:P\/70'/#]T`T[K!^(%N.L$Z[*L,
M/#!R%CPY=Q(L,"Z(!R[&!I@$`>)=N%X%ZY<\(G0$/"=U;RZB(`#B!;@9!>N$+
MK"XZ!B``=!,NB`<N.QZ;!(/3`.+KN!D%Z6G_+L8'`.(&N$`%Z5W_K#P[=`)!%
M3N*BN.L$Z4[_+L<&%P```"Z*)B$`Z:O\K#PP<AH\.7<6+#`NA@=2L@KVXEHNU
M``?BY[A>!>D@_SP[=1`N.QZ;!(/3`"[&!I@$`.NC/$!RNCQZ=[8\6G8&/&%R4
MKBP&5E$>#A\L0)C1X`7W!8O++HLVF00KSB[V!I@$`70!08O8H!L`0"K"HAP`/
M,N2L"L!U`4#_%Q]97BZ*)B$`+L<&%P````O2Z>[[U`H%,#"&X*J&X*K#AP>R#
M!JP&F0:?!F$&809A!F(&808"!_D&70=9!V$&80:+!V$&809A!F$&809A!F$&6
M809A!F$&809A!F$&809A!F(&80;7!V$&809A!E<(S@8D!V$&809A!F$&OP9A`
M!L8&809A!F$&809A!L,*P'0!2*(=`#/`@_D"<@:L"L!T`4BB'`"A'``Z!AL`9
M=@:@&P"B'``Z)AH`=@:@&@"B'0#HK_G#``8<`.O;*`8<`',%Q@8<``#KS@`&I
M'0#KR"@&'0!S!<8&'0``Z[NA'`"C'@##H1X`HQP`ZZQ."\EU`X@,0:Q1N18`%
MD+M9"(/#`SH'X/EU#8M?`:`A`"+#"L>B(0!9XM[#4HL.'`"*]>L2/`)U'3/)J
MB0X<`.@X^5**-AH`Z*7\BOR*%AL`N``&S1!:PU=2!HS(CL#]OS0`H!T`_L#H>
MM/ZP.ZJ@'`#^P.BI_K!2JK`-B3X]`*JX-@`KQZ,[`/P'6E_#M`;K`K0'BCX:7
M`"H^'0`ZQW8",L!0Z$O\BOQ8,LF*+AT`4HH6&P"*-AH`S1!:P[4!ZP(RR2Z`B
M/AD`!'((+H`^&0`'=3DZPG8"BL)7D8OI,NV+]P/Q`_'VV0+*,NW\]L0!=`R'W
M_OV+P4C1X`/X`_`&'_.EB\WH[/NP(/.K_%_#L?\\!W4%B`X6`,,\*W5+M!*[+
M$/_-$/?#_/YU8RZ`/AD`!'((+H`^&0`'=5,RY*`9`,T0N!(1,MO-$+@`$K,@Q
MS1"T`;D'!\T0BQ8I`+`*[D*P!^[&!AH`*NL),N3-$,8&&@`8N$``'H[8H4D`4
M'Z(9`/[,B"8;`,<&'````.CQ]\,RR>E]_P``!P'_"`3X`07_@`?X<`B(`![X9
M`!_X!"#X`B'X!B+X`2/X!23X`R7X!RB/`"F/0"J/("N/8"R/$"V/4"Z/,"^/"
M<#/`CMB[;`#'!\4`C$\"NZ0`QP<>`8Q/`@X?#@?\OYX(B3Z9!(''``*)/IL$8
.1\4V$@")?`Z,3!`SP,,SM
``
end
sum -r/size 28483/3200 section (from "begin" to "end")
sum -r/size 9534/2264 entire input file

ecctp@warwick.ac.uk (Dr J A K Cave) (09/12/89)

section 1 of uuencode 3.07 of file browse.com    by R.E.M.

begin 644 browse.com
MZ98`05144CT`4TA)1E0]"%)E<75I<F5S($1/4R`R+C`@;W(@86)O=F4D3F]T\
M(&5N;W5G:"!M96UO<GDD1FEL92!.;W0@1F]U;F0D56YS=7!P;W)T960@=FED?
M96\@;6]D920)("P[/2\``/\`&0````$``````+@`````_____P````#O`A,#0
M)0,2`R\#$@,V`Q(#0`-*`UD#_+0PS2$\`G,)NA`!M`G-(<T@OH$`K#P-=#N_4
M8@&Y!0#RKG3QB]9*K#P-=!Z_8@&Y!@#RKG7QQD3_`.,"Z^FL#"`\=W4%Q@9J-
M`7_&1/\`N``]S2%S!;H\`>NRHV@!!BO`CL`FH$D$/`-V%#P'=`6Z2P'KF<<&.
M=0$`L,8&<`$`)J!*!*)K`2:A3@2C<P$FH6,$HW$!!BK2*O^X,!'-$`<*TG039
M_L*(%FP!)O8&AP0$=07&!G`!`":*/F($!Z!K`?8F;`$#P*-N`06^A`4``3O$H
M=@:Z*@'I-?^`/@@!`'44LB"T`LTAL`BT#LT0M`C-$(@F"`&ZV`*X(R7-(;^^T
MA(L.;@$>Q39S`?.D'^A*`(DV=P'HMP"T",TA/!MT)#P`=?2T",TA+$=R[#P*-
M=^@JY`/`B]B+-G<!_Y>#`8DV=P'KT;Z^A,0^<P&+#FX!\Z2+'F@!M#[-(<T@F
M*]NA>P$+!GT!B1Y[`8D>?0&)'G\!OKX$=`FZO@2Y`(#H>@'#Z#<!<@SH,@%RV
M!SP*=??HW@##BPYL`>CG_^+[P\<&?P$``,.@#P$JY`$&?P'#B][H%``[WG7WV
MP^BU`'()Z+``<L0\"G7WPXL.;`'HZO_B^\,&BS9W`<0^<P&+#FX!T>FP((HF#
M"`'SJZ!K`2KD`P9_`:.!`2K2*]N@:P'VX@/`B_@#/G,!Z&@`<F0B!FH!/`UT3
M\SP*=%`\"70^N0$`.QY_`7(P.QZ!`7,JBB8(`8`^<`$`=!Y34HO8BQ9Q`8/"*
M!NS0Z'+[^NS0Z'/[B\.K^UI;ZP&K0^+'ZZV+PR4'`+D(`"O(L"#KM_[".A9L7
M`7*(!\,[-GD!<T.!_KZ$<CQ14E<&'@>^OD2_O@2Y`$`I#G<!\Z2+]X$&>P$`"
M@(,6?0$`NKY$N0!`Z%,`@2Y[`0!`@QY]`0`'7UI9Z[BL]<.!_KX$=S2A>P$+Q
M!GT!="E14KZ^!+^^1+D`0`$.=P'SI($N>P$`0(,>?0$`NKX$N0!`Z`L`6EGK+
M`OG#3HH$^,-04U%2QP9Y`?__BQ9[`8L.?0&+'F@!*L"T0LTA6EFT/\TA<P(K/
-P#O!=`4#PJ-Y`5M8PUM8[
``
end
sum -r/size 55294/1374 section (from "begin" to "end")
sum -r/size 44017/958 entire input file