                  From the files of the Hack Squad:
                          The Hack Report
                   -----------------------------
                    Report Date: April 3, 1992

  Welcome to the twelfth issue of The Hack Report.  This is a series
  of reports that aim to help all users of files found on BBSs avoid
  fraudulent programs, and is presented as a free public service by
  the FidoNet International Shareware Echo and the author of the report,
  Lee Jackson (1:382/87.4).

| This week has been interesting, to say the least.  Another hack of
| TheDraw comes out, hot on the heels of a hack found last week.
| Also, shareware turned commercial QModem shows up as "shareware"
| again, and the RIME echo verifies as a pirate a program listed as
| questionable last week.  Thanks to everyone who has helped put
| this report together.  If you have any comments, please NetMail me
| at 1:382/87.4.

  NOTE TO SYSOPS: The Hack Report may be freely posted as a bulletin
  on your BBS, subject to these conditions:

             1) the latest version is used,
             2) it is posted in its entirety, and
             3) it is not altered in any way.

  NOTE TO OTHER READERS: The Hack Report (file version) may be freely
  uploaded to any BBS, subject to the above conditions, and only if
  you do not change the filename.  You may convert the archive type
  as you wish, but please leave the filename in its original HACK???.*
  format.  The Hack Report may also be cross-posted in other networks
  (with the permission of the other network) as long as it meets
  the above conditions and you give appropriate credit to the FidoNet
  International Shareware Echo (and the author <g>).

  The idea is to make this information available freely.  However,
  please don't cut out the disclaimers and other information if you
  use it, or confuse the issue by spreading the file under different
  names.  Thanks!

  DISCLAIMER: The listings of Official Versions are not a guarantee
  of the files' safety or fitness for use.  Someone out there might
  just be sick-minded enough to upload a Trojan with an "official"
  file name, so >scan everything you download<!!!  The author of
  this report will not be responsible for any damage to any system
  caused by the programs listed as Official Versions, or by anything
  using the name of an Official Version.

  Now that the Draconian stuff is out of the way, let's get to the
  report!

  *****************************************************************

                          Hacked Programs

  Here are the latest versions of some programs known to have hacked
  copies floating around.  Archive names are listed when known, along
  with the person who reported the fraud (thanks from us all!).

   Program              Hack(s)            Latest Official Version
   -------              -------            -----------------------
   CatDisk              CDISK510                   CDISK615
                        CDISK530
                        CDISK661
      Reported By:  Jeff Kaplow (1:120/234)

   CompuShow            CSHOW801                   CSHW843
                        CSHOW831
                        CSHOW851
      Reported By:  Paul Brazil
      (Note:  Any version ending with a B, such as CSHW841B, is _not_
       a shareware version.  This is the enhanced version received
       with the user's registration and is not to be distributed. 
       Consider all B archives to be pirated copies.)

   Las Vegas EGA Casino (unknown)
      Reported by the author, Diana Gruber, in the ILink net,
      relayed by Richard Steiner (1:282/85)
      (Note:  a version of this program sold through Gemini
       shareware outlets with the title screen "Special GEMINI
       game disk" and a version calling itself the "Ledyard$
       EGA Casino" have been distributed.  No archive names
       have been supplied yet.)

   List                 LIST8                      LIST76B
                        LIST18
      Reported by: The Hack Squad (from the Buerg BBS)

|  Math Master          MATHMSTR                   M-MST301
|     Reported by: James Frazee (1:343/158)

   PKZip                PKZIP120                   PKZIP110
                        PKZIP20B
      Reported by: Fred Towner (1:134/73)
                        PKZ201.ZIP
                        PKZ201.EXE
      Reported by: Jim Westbrook (1:382/29)
      (Note:  Version 1.93a is official, but is a wide alpha test
       release.  According to Joe Pantuso of PKWare Tech Support,
       version 2.0 is not out yet, either:  ignore all magazine ads
       to the contrary.)

   QEdit Advanced       XEDIT                      QEDIT215
      Reported by: Sammy Mitchell, Author
      (thanks to Rand Nowell and Joe Morlan for relaying the report)

|  Telegard 2.9E Alpha  TG29EALP                   Telegard 2.7
|     Reported by: Karen Maynor (1:3640/5)
|     (Found on the NightOwl CD-ROM disc version 5.0)

   Telegard Security   * See "The Trojan Wars"
      Package

   Telix                Telix v3.20                Telix v3.15
                        Telix v3.25
      Reported by: Brian C. Blad (1:114/107)
                       *Telix v4.00
                        Telix v4.15
      Reported by: Barry Bryan (1:370/70)
                        Telix v4.25
                        MegaTelix
      (* - hack reported seen, but not confirmed; anyway, 4.0 is NOT
       official yet.)

|  TheDraw              TDRAW430                   TDRAW450
                        TDRAW500
      Reported By: Ian Davis, Author
                        TDRAW600
      Reported By: Hawley Warren (1:120/297)
|                       TDRAW800
|     Reported By: James Carswell (1:153/775)

   Turbo Antivirus      Version 9.00b              Version 8.10
                        Version 9.01a
                        (Archive names unknown)
      Reported by: Thomas Ruess (2:246/24)

   X00 Fossil           X00V130                    X00V124
                        X00V130J

  ================================================================

                            Hoax Alert:

  Tim Fitzgerald of 1:3800/18.0 has concluded his test on XTRATANK,
  and has confirmed what we suspected all along:  it doesn't work.
  Here is how you can tell, according to Tim:

      1. Run CHKDSK and write down the free space it reports as free.
      2. Do a DIR command and write down what XTRATANK reports.
      3. Copy any text file to a new text file.
      4. Repeat steps 1 and 2, and compare.

  You will see that XTRATANK reports that twice as much disk space
  is taken up by the new text file.  Tim concludes that XTRATANK fools
  you into thinking that it gives you more space by doubling what
  the DOS DIR command reports.  Fortunately, it is still harmless.
  Consider it a hoax that doesn't work.


  Also on the COMM frontier, a text file describing how to upgrade a
  2400 modem to a 9600 has been circulating.  Another similar file
  about converting from 2400 to 14400 has been seen.  Billy Cash
  (1:226/70) sent a copy of one called 2496.ZIP to The Hack Squad.
  He says he has an "antidote" posted on his board called 2496X.ZIP
  which explains why 2496 is a fraud.  His "antidote" calls 2496 a
  "hardware virus." Original, and appropriate.

  If you like your modem, please ignore these files: the name of the
  author of 2496, "Death Bringer", should explain why.


  Other previously reported hoaxes:

  Filename       Claimed use/Actual activity/Reporter(s)
  ------------   ---------------------------------------------------
  AMIGA.*        Claims to allow IBM/Clones to read Amiga Workbench
                 Disks: displays a picture of an Amiga Workbench disk
                 on your screen, then spins your A: drive and locks
                 your system.  From Suriya Matsuda, Jacob Kanafoski,
                 Derek Vanmunster (1:229/418), and Jeff Hancock (1:3600/7).

  BIMOD126.*     Claims to be version 1.26 of BiModem - actually v1.24
                 renamed and re-archived.

  CREDITFX.*     Promises to repair your credit if you buy the full
                 program for $39.00:  the phone number in the file
                 has been disconnected.  From Paul Reimche (1:206/2404).

  ================================================================

                          The Trojan Wars

| Finally, a quiet week on the western front!  Only one Trojan
| to watch for this time, and it isn't really a Trojan...or is it?
| Read on to see what this is all about.


| The FidoNet SHAREWRE echo featured a discussion this week on a
| file called DRAINC.*.  This file is a "joke program" that "drains
| water from your hard disk." Apparently, a few years ago, a
| similarly described file was being posted.  The older file
| actually formatted your hard drive (and drained your data instead
| of water).  However, in its current incarnation, the file is an
| honest joke and is harmless.  So, be careful if you run this
| program: you never know which one was posted.


  Bob Keegan of 1:371/26.20 reports in both the SHAREWRE and VIRUS
  echos that he has found a Trojan file called XLIST214.  Bob says
  that the real program is a utility for RemoteAccess and Opus BBS
  systems.  The Trojan version deletes all of your files, prints a
  message to the screen that says, "I will not buy this record, it
  is scratched," and leaves a FILES.BBS file that contains the line,
  "and on distant stars slimy creatures scan there skies." He says
  SCANv86 reports the offending executable, X_LIST.EXE, as clean,
  but the message it plants in your FILES.BBS can be seen in the
  .exe file by using a hex viewer.  RA and Opus SysOps would be wise
  to delete this file if they receive it.


  Scott Raymond, author of the Telegard Security Package (which is
  listed in the Hacked Programs section), has sent your intrepid
  reporter additional information about the hacked version of his
  file (latest official version TGSEC17.ZIP).  The hack,
  TGSEC16.ZIP, is actually a dropper and a fraud combined.  The
  dropper is in one of the executables in the file, which will
  infect your system with the Dark Avenger virus.  The fraud is in
  the documentation: instead of telling you how to configure
  Telegard to prevent break-ins, it the instructions (if followed)
  make it easy for almost anyone to hack into your system.  He sent
  a copy of the dropper, which I must admit that I did not unzip: I
  only have one system, which I need to keep free of DaV or any
  other nasties.  Thankfully, he warned me about it in his NetMail.
  So, allow me to warn you - avoid TGSEC16.ZIP!


| There are three versions of SCAN floating around that you should
| avoid.  These are versions 87, 88, and 96.  Trojan/dropper activity
| is suspected, but not confirmed.  As of this writing, version 89b is
| the latest official release (see the ???Questionable Files??? section
| for a clarification).


  Please be aware that the PKZip v2.0B hack reported in the hack
  section of this report could be a Trojan.  According to the report
  filed in the VIRUS_INFO echo by Fred Towner, the archive (an ARJ
  archive, no less(!)) had these files in it:

        PKZIP20B.EXE
        UNKNOWN.NFO
        MUSTREAD.COM (archived with PKLITE)
        WATCHME!.EXE (archived with PKLITE)

  Fred was wise enough not to try and run any of these programs, so
  Trojan activity has not been confirmed.  Fortunately, the PKZ201
  hack appears to be nothing more than a hack of the 1.93 Alpha
  release.  Some relief, but a hack is a hack.


  Other previously reported Trojans/Droppers:

  Filename        Claimed use/Actual activity/Reporter(s)
  ------------    ---------------------------------------------------
  OCEAN.ZIP       From the BBS description: "Wonderful Game, Reward for
  PLANTS.ZIP      the person who conquers it 1 time, Good luck, how does
  RAINBOW.ZIP     30,000 bucks sound to you if you break the pattern, try
                  this game, it is wonderful, waht a challenge, bet you
                  can't break the pattern. $50, 000 if you do it twice."
                  Actually a compiled batch file that tries to erase all
                  files on your C: drive.  From Richard Dale (1:280/333).

  Obnoxious       "Tetris" clones for the Macintosh - actually droppers
    Tetris        of the MBDFA virus.  Via Paul Ferguson (1:109/229)
  Tetriscycle     in the VIRUS_INFO echo.
  Ten Tile Puzzle

  PSI3.ARJ        Passing itself as the LHA Archiver, version 3.00.  It
                  destroys your partition table, boot sector, and parts
                  of FAT 1 and FAT 2.  From Nemrod Kedem (2:403/138).

  ZAPPER15.*      PSI3, mentioned above, recommends an "antivirus"
                  program called ZAPPER15.* to remove a virus called
                  "PSQR".  ZAPPER15 is another Trojan which overwrites
                  your hard disk's boot sector with random garbage data
                  from memory.  It contains no viral code.  Also from
                  Nemrod Kedem (2:403/138)

  GREYSCAL.*      Claims to be a monitor adjustment utility - actually
                  a dropper - infects files on your hard drive with the
                  FISH virus through the README.EXE file in the archive.
                  Not detectable by any scanner.  From Bill Logan
                  (1:300/22).

  MONOP3-0.*      Supposed to be Monopoly for Windows.  Contains
                  FORMAT.COM from DOS 4.01 and STACKEY v2.1 (renamed as
                  MONOP1.COM and MONOPOLY.COM and invoked by a batch
                  file called README!!.BAT).  Will try and format your
                  hard drive - a volume label on your HD will thwart
                  this one.  From Derek Vanmunster (1:229/418).

  ================================================================

                    Pirated Commercial Software

  Program                 Archive Name(s)       Reported By
  -------                 ---------------       -----------
  Above Disk v3.00A       EXP-MEM.*             Dale Woloshin (1:163/211.3)
                                                and Wolfgang Fritz

| BeetleJuice (game)      BJUICE.*              Alan Hess (1:261/1000)
|                         BJ.*                  Bill Blakely
|                                                 (RIME Shareware echo)

  Commander Keen part 2   #2KEEN.*              Steve Hodsdon (1:132/119.12)

  Double Disk             DDISK214.*            Ronald McGill (1:167/149)

  Duke Nukem parts 2 & 3  DUKEZIP2.EXE          Steve Hodsdon (1:132/119.12),
                          #2DUKE.*              Craig Demarsh (1:260/213),
                          DUKEZIP3.EXE          and Hal Thompson (1:353/220)

  Eagle's Nest (game)     Unknown               Mike Headley (1:362/112)
                          (not in wide distribution)

  Fastback Plus v2.0      FBPL200.*             Bogie Bugsalewicz (1:115/738)

  Flashlink MNP Emulator  FLASHLNK.*            Several

  LotusWorks v1.0         LWORKS.*              Brian Luker (1:167/149)

  Mac-in-Dos              CLINK.*               Stuart Kremsky (1:125/28)
                     (not the SEALink protocol)
|                         MAC-DOS.*             Ron Bass (1:128/13.3)
|                                               Leslie Meehan, original
|                                                 reporter (unknown)

  Microsoft Mouse Driver  MOUSE810.*            Bat Lang (1:382/87)

  MTE MNP Emulator        MTE215.*              Bat Lang (1:382/87)
                          MTE210E.*
                          MTE210F.*
                          MTE210G.*
                          MX5.*                 Wolfgang Fritz
                          MX6.*

  Optune                  OPTUNE.*              Bat Lang (1:382/87)
                          OPTUNE11.*
                          OPTUNE12.*            Jeff Dunlop (1:203/16)

| QModem 5.0              QM50.*                Daniel Hagerty (1:208/216)

  SimCGA                  SIMCGA40.*            Joe Morlan (1:125/28)
                          SIMCGA41.*

  SIMCITY                 SIMCITY.*             Mark Visser

  Solitare Royale         SOLITRYL.*            Dan Brady (1:282/108)
                          SOLIT.*               Bud Webster (1:264/165.7)

  Spot (7-Up game)        SPOT.*                Steve Hodsdon (1:132/119.12)

  Squish 2.1              SQUISH21.*            Several
                                                (verified by Joe Morlan)

  Tunnels of Armageddon   TUNNELS1.*            Wolfgang Fritz (1:249/140)
                          TUNNELS2.*

  ================================================================

                  ?????Questionable Programs?????

| To repeat last week's clarification, a release of McAfee's SCAN,
| called SCAN89BT, was listed as questionable.  This week, I'm
| pleased to announce that it was legitimate.  Several readers
| assured me that McAfee does use PKLite to compress their
| executables, and I even called the McAfee BBS to try and verify
| this.  Sure enough, there was SCAN89BT.  Upon inspection after
| download, I saw the PKLite signature inside the .exe file.  In
| short, I was mistaken in reporting it as questionable, and I
| apologize to all who read this and to McAfee Associates.  Please
| understand - a healthy dose of paranoia always surrounds a new
| anti-viral file.  Anyway, the non-beta version (SCAN89B, a bug fix
| of SCAN89) is now out on UtilNet, so I believe the problem has
| solved itself (whew!).


| Alan Hess of 1:261/1000 reported that a game called BeetleJuice
| is making the rounds of the BBSs in the Baltimore area.  The file
| name he saw is BJUICE.ZIP.  Bill Blakely, reporting in the RIME
| Shareware echo, has also seen this in the Atlanta, GA area under
| the filename BJ.ZIP.  He confirmed that this is a commercial game.


  Zach Adam of 1:2200/103 has reported a file called MTG2400.*.
  The description says this program will run a 2400bps modem like
  a 4800bps modem.  This sounds a bit like the MTE program listed
  in the Pirated Commercial Software section of this report, but
  no confirmation of this has been received.  Any information would
  be appreciated.


  ****************************************************************

                             Conclusion

  If you see one of these on a board near you, it would be a very
  friendly gesture to let the SysOp know.  Remember, they can get
  in just as much trouble as the fiend who uploads pirated files,
  so help them out if you can.


                      ***HACK SQUAD POLICY***

  The intent of this report is to help SysOps and Users to identify
  fraudulent files.  To this extent, I give credit to the reporter
  of a confirmed hack.  On this same note, I do _not_ intend to "go
  after" any BBS SysOps who have these programs posted for d/l.  The
  Shareware World operates best when everyone works together, so it
  would be counter-productive to "rat" on anyone who has such a file
  on their board.  Like I said, my intent is to help, not harm.
  SysOps are strongly encouraged to read this report and remove all
  files listed within from their boards.  I can not and will not
  take any "enforcement action" on this, but you never know who else
  may be calling your board.  Pirated commercial software posted for
  d/l can get you into _deeply_ serious trouble with certain
  authorities.

  Updates of programs listed in this report need verification.  It
  is unfortunate that anyone who downloads a file must be paranoid
  about its legitimacy.  Call me a crusader, but I'd really like to
  see the day that this is no longer true.  Until then, if you
  _know_ of a new official version of a program listed here, please
  help me verify it.

  On the same token, hacks need to be verified, too.  I won't be
  held responsible for falsely accusing the real thing of being a
  fraud.  So, innocent until proven guilty, but unofficial until
  verified.

  Upcoming official releases will not be included or announced in
  this report.  It is this Co-Moderator's personal opinion that the
  hype surrounding a pending release leads to hacks and Trojans,
  which is exactly the opposite of what I'm trying to accomplish
  here.

  If you know of any other programs that are hacks, bogus, jokes,
  hoaxes, etc., please let me know.  Thanks for helping to keep
  shareware clean!

Lee Jackson, Co-Moderator, FidoNet International Echo SHAREWRE (1:382/87)
