anderson@Apple.COM (Clark Anderson) (06/07/90)
An update on the Steroid trojan horse, from AppleLink 6-6-90
--clark
June 6, 1990 STEROID TROJAN HORSE UPDATE!
----------------------------------------------
UPDATE: "Trigger date for STEROID is July 1, not June 6"
There is a Trojan Horse called "Steroid". It is an INIT that claims to speed
up QuickDraw on Macintosh computers with 9" screens. The INIT contains code
that checks for the date being greater than JULY 1,1990. If it is, it will
ERASE all mounted drives.
Having the Comm Toolbox installed seemed to interfere with the INIT and keep
the erase from happening. The SE in the test simply crashed at boot time.
STEROID INFORMATION
-------------------
TYPE : INIT
CREATOR : qdac
CODE SIZE : 1080
DATA SIZE : 267
ID : 148
INIT Resource Name: QuickDraw Accelerator
File Name : " Steroid" (First 2 characters are ASCII 1)
Created : June 2, 1990, 11:24 AM
Version : Steroid 1.1
WHAT TO DO
----------
If your disk becomes erased, you can use SUM II Disk Clinic to recover the
deleted files. We have tried this and it seems to work. If you read this
before July 1 1990, REMOVE the Steroid INIT from all disks IMMEDIATELY. Throw
it in th Trash and Empty the trash.
Try to find out where you got the file from and notify them of the danger.
If you use Virus Detective, a search string to find this trojan is:
Resource INIT & Size<1200 & WData FE680C6E#E4EBA#F60 ; For finding Steroid
Trojan
If you receive further Steroid information, please send a link to MICRO.SUPT or
micro.supt@applelink.apple.com. Check the virus folder on AppleLink for future
updates:
Hotlinks:Desktop Services...:Virus Information and Utilities
Thomas Scott
Desktop Services
AppleLink: MICRO.SUPT
*****************************************************
--
-----------------------------------------------------------
Clark Anderson InterNet: anderson@apple.com
CPU Engineering AppleLink: C.ANDERSON
Apple Computer, Inc BellNet: 408-974-4593
"I speak only for myself, much to my employer's relief..."
-------------------------------------------------------------