From: "Paul S. Penrod" <furballs@netcom.com>
Date: Tue, 16 Apr 1996 16:50:22 +0800
To: Ramli Bin Jaafar <wolv@infosys.utm.my>
Subject: Re: Trojan Horse Loose On The Internet
In-Reply-To: <19960415073947953.AAA74@Executioner.utm.my>
Message-ID: <Pine.3.89.9604151845.A4741-0100000@netcom12>
MIME-Version: 1.0
Content-Type: text/plain



Yes, the PKZIP 3.0 virus does exist, but it is a trojan, not a virus. You 
have to run the program - then it does a dance on your disk with less 
than pleasurable results. The latest official version of PKZIP I know of is 
2.04g. Any other version greater than this should be suspect.

...Paul

-------------------------------------------------------------------------

"Faced with the choice between changing one's mind and proving that there
 is no need to do so, almost everybody gets busy on the proof"

                                            -- John Kenneth Galbraith

"Success is attending a funeral as a spectator"

                                            -- E. BonAnno 

-------------------------------------------------------------------------

On Mon, 15 Apr 1996, Ramli Bin Jaafar wrote:

> According to several reliable sources there is a deadly virus on the
> Internet.  This is NOT a hoax! 
> CAN ANYBODY CHECK THIS OUT, PLEASE..
> 
> Note: The reliability of all information below is UNKNOWN.
>      
> WHAT:
> Virus Alert:  PKZIP 3.0 Trojan Loose on the Internet
>     
> BACKGROUND:
> A trojan (virus) program, PKZIP 3.0, which is advertised as an updated
> version of the popular compression utility PKZIP, is currently being
> distributed on the Internet.  Please note that this trojan is REAL and
> DESTRUCTIVE.  Once executed, this program will destroy data on your hard
> drive; there's no stopping it.
> 
> According to PKWARE, makers of PKZIP, the only released versions of PKZIP
> are:  1.10, 1.93, 2.04c, 2.04e and 2.04g.  All other versions currently
> circulating on the Internet are suspect and should not be used.
> 
> ACTION REQUIRED:
> Please do not download or execute any files that are named PKZ300B.EXE,
> PKZ300B.ZIP, PKZIP300.ZIP, PKZIP300.EXE, etc. from the Internet or other
> external source.
>