From: Alan Olsen <alano@teleport.com>
Date: Tue, 16 Apr 1996 03:13:33 +0800
To: cypherpunks@toad.com
Subject: Re: Trojan Horse Loose On The Internet
Message-ID: <2.2.32.19960415152907.00a5b394@mail.teleport.com>
MIME-Version: 1.0
Content-Type: text/plain


At 03:40 PM 4/15/96 +0800, Ramli Bin Jaafar wrote:
>According to several reliable sources there is a deadly virus on the
>Internet.  This is NOT a hoax! 
>CAN ANYBODY CHECK THIS OUT, PLEASE..
>
>Note: The reliability of all information below is UNKNOWN.
>     
>WHAT:
>Virus Alert:  PKZIP 3.0 Trojan Loose on the Internet

Not again!

There is a trojan that claims to be a new version of PKZip.  (Actually there
is a long list of them.)  The program you are refering to here is about
three years old or more!  Some of them destroy hard drives, some of them do
not.  (One I have seen is pretty buggy.) 

The reasons these warnings have started to crop up again is that the program
was sighted by someone who did not remember the last go around with these
trojans and wrote a panic type broadsheet.  The posting is now curculating
on every newsgroup and mailing list on the planet.  (At least once.)  I
expect that it has attained "The Shergold Effect" and taken on a life of its
own.

As for the data on the released versions of PKZip, there is a Windows
version (2.01 I think) that you do not have listed and is available from the
PKWare site.  There are also non-pkware unzippers that are not trojans.
(Translated over from the Unix world.  They are useful for handling long
file names. (Something the PKWare version does not always do gracefully.))

Facts are useful, but the panic style of the warnings on this problem make
things worse, not better.
---
Alan Olsen -- alano@teleport.com -- Contract Web Design & Instruction
        `finger -l alano@teleport.com` for PGP 2.6.2 key 
                http://www.teleport.com/~alano/ 
  "We had to destroy the Internet in order to save it." - Sen. Exon