                  From the files of the Hack Squad:
                          The Hack Report
                   -----------------------------
                    Report Date: April 10, 1992

  Welcome to the thirteenth issue of The Hack Report.  This is a series
  of reports that aim to help all users of files found on BBSs avoid
  fraudulent programs, and is presented as a free public service by
  the FidoNet International Shareware Echo and the author of the report,
  Lee Jackson (1:382/87.4).

  This week has been a week of confirmations and explanations.  A
  file reported as a Trojan last week undergoes scrutiny, and the
  Hack Squad gets it "from the horse's mouth" on a couple of other
  files.  Thanks to everyone who has helped put this report
  together.  If you have any comments, please NetMail me at
  1:382/87.4.

  NOTE TO SYSOPS: The Hack Report may be freely posted as a bulletin
  on your BBS, subject to these conditions:

             1) the latest version is used,
             2) it is posted in its entirety, and
             3) it is not altered in any way.

  NOTE TO OTHER READERS: The Hack Report (file version) may be freely
  uploaded to any BBS, subject to the above conditions, and only if
  you do not change the filename.  You may convert the archive type
  as you wish, but please leave the filename in its original HACK???.*
  format.  The Hack Report may also be cross-posted in other networks
  (with the permission of the other network) as long as it meets
  the above conditions and you give appropriate credit to the FidoNet
  International Shareware Echo (and the author <g>).

  The idea is to make this information available freely.  However,
  please don't cut out the disclaimers and other information if you
  use it, or confuse the issue by spreading the file under different
  names.  Thanks!

  DISCLAIMER: The listings of Official Versions are not a guarantee
  of the files' safety or fitness for use.  Someone out there might
  just be sick-minded enough to upload a Trojan with an "official"
  file name, so >scan everything you download<!!!  The author of
  this report will not be responsible for any damage to any system
  caused by the programs listed as Official Versions, or by anything
  using the name of an Official Version.

  Now that the Draconian stuff is out of the way, let's get to the
  report!

  *****************************************************************

                          Hacked Programs

  Here are the latest versions of some programs known to have hacked
  copies floating around.  Archive names are listed when known, along
  with the person who reported the fraud (thanks from us all!).

   Program              Hack(s)            Latest Official Version
   -------              -------            -----------------------
   CatDisk              CDISK510                   CDISK615
                        CDISK530
                        CDISK661
      Reported By:  Jeff Kaplow (1:120/234)

   CompuShow            CSHOW801                   CSHW843
                        CSHOW831
                        CSHOW851
      Reported By:  Paul Brazil
      (Note:  Any version ending with a B, such as CSHW841B, is _not_
       a shareware version.  This is the enhanced version received
       with the user's registration and is not to be distributed. 
       Consider all B archives to be pirated copies.)

   Las Vegas EGA Casino (unknown)
      Reported by the author, Diana Gruber, in the ILink net,
      relayed by Richard Steiner (1:282/85)
      (Note:  a version of this program sold through Gemini
       shareware outlets with the title screen "Special GEMINI
       game disk" and a version calling itself the "Ledyard$
       EGA Casino" have been distributed.  No archive names
       have been supplied yet.)

   List                 LIST8                      LIST76B
                        LIST18
      Reported by: The Hack Squad (from the Buerg BBS)

   Math Master          MATHMSTR                   M-MST301
      Reported by: James Frazee (1:343/158)

   PKZip                PKZIP120                   PKZIP110
                        PKZIP20B
      Reported by: Fred Towner (1:134/73)
                        PKZ201.ZIP
                        PKZ201.EXE
      Reported by: Jim Westbrook (1:382/29)

   QEdit Advanced       XEDIT                      QEDIT215
      Reported by: Sammy Mitchell, Author
      (thanks to Rand Nowell and Joe Morlan for relaying the report)

   Telegard 2.9E Alpha  TG29EALP                   Telegard 2.7
      Reported by: Karen Maynor (1:3640/5)
      (Found on the NightOwl CD-ROM disc version 5.0)

   Telix                Telix v3.20                Telix v3.15
                        Telix v3.25
      Reported by: Brian C. Blad (1:114/107)
                       *Telix v4.00
                        Telix v4.15
      Reported by: Barry Bryan (1:370/70)
                        Telix v4.25
                        MegaTelix
      Verified by Jeff Woods, Exis, Inc., in the TELIX echo

   TheDraw              TDRAW430                   TDRAW450
                        TDRAW500
      Reported By: Ian Davis, Author
                        TDRAW600
      Reported By: Hawley Warren (1:120/297)
                        TDRAW800
      Reported By: James Carswell (1:153/775)

   Turbo Antivirus      Version 9.00b              Version 8.10
                        Version 9.01a
                        (Archive names unknown)
      Reported by: Thomas Ruess (2:246/24)

   X00 Fossil           X00V130                    X00V124
                        X00V130J

  ================================================================

                            Hoax Alert:

  Tim Fitzgerald of 1:3800/18.0 has concluded his test on XTRATANK,
  and has confirmed what we suspected all along:  it doesn't work.
  Here is how you can tell, according to Tim:

      1. Run CHKDSK and write down the free space it reports as free.
      2. Do a DIR command and write down what XTRATANK reports.
      3. Copy any text file to a new text file.
      4. Repeat steps 1 and 2, and compare.

  You will see that XTRATANK reports that twice as much disk space
  is taken up by the new text file.  Tim concludes that XTRATANK fools
  you into thinking that it gives you more space by doubling what
  the DOS DIR command reports.  Fortunately, it is still harmless.
  Consider it a hoax that doesn't work.


  Also on the COMM frontier, a text file describing how to upgrade a
  2400 modem to a 9600 has been circulating.  Another similar file
  about converting from 2400 to 14400 has been seen.  Billy Cash
  (1:226/70) sent a copy of one called 2496.ZIP to The Hack Squad.
  He says he has an "antidote" posted on his board called 2496X.ZIP
  which explains why 2496 is a fraud.  His "antidote" calls 2496 a
  "hardware virus." Original, and appropriate.

  If you like your modem, please ignore these files: the name of the
  author of 2496, "Death Bringer", should explain why.


  Other previously reported hoaxes:

  Filename       Claimed use/Actual activity/Reporter(s)
  ------------   ---------------------------------------------------
  AMIGA.*        Claims to allow IBM/Clones to read Amiga Workbench
                 Disks: displays a picture of an Amiga Workbench disk
                 on your screen, then spins your A: drive and locks
                 your system.  From Suriya Matsuda, Jacob Kanafoski,
                 Derek Vanmunster (1:229/418), and Jeff Hancock (1:3600/7).

  BIMOD126.*     Claims to be version 1.26 of BiModem - actually v1.24
                 renamed and re-archived.

  CREDITFX.*     Promises to repair your credit if you buy the full
                 program for $39.00:  the phone number in the file
                 has been disconnected.  From Paul Reimche (1:206/2404).

  ================================================================

                          The Trojan Wars

  If it looks like something is missing, it isn't - it's just been
  relocated (see the Correction on XLIST124).  If you are reading
  the report for the first time, this is one section you shouldn't
  skip:  read on and see why.


  The FidoNet SHAREWRE echo featured a discussion this week on a
  file called DRAINC.*.  This file is a "joke program" that "drains
  water from your hard disk." Apparently, a few years ago, a
  similarly described file was being posted.  The older file
  actually formatted your hard drive (and drained your data instead
  of water).  However, in its current incarnation, the file is an
  honest joke and is harmless.  So, be careful if you run this
  program: you never know which one was posted.

| The Hack Squad's own copy of this program, along with a related one
| called DRAINA.*, have been sent to Bill Logan, a McAfee agent, for
| testing.  No results yet - stay tuned.


  Scott Raymond, author of the Telegard Security Package (which is
  listed in the Hacked Programs section), has sent your intrepid
  reporter additional information about the hacked version of his
  file (latest official version TGSEC17.ZIP).  The hack,
  TGSEC16.ZIP, is actually a dropper and a fraud combined.  The
| dropper is in both of the executables in the file, which will
  infect your system with the Dark Avenger virus.  The fraud is in
  the documentation: instead of telling you how to configure
  Telegard to prevent break-ins, it the instructions (if followed)
  make it easy for almost anyone to hack into your system.  He sent
  a copy of the dropper, which I must admit that I did not unzip: I
  only have one system, which I need to keep free of DaV or any
  other nasties.  Thankfully, he warned me about it in his NetMail.
  So, allow me to warn you - avoid TGSEC16.ZIP!


  There are three versions of SCAN floating around that you should
  avoid.  These are versions 87, 88, and 96.  Trojan/dropper activity
  is suspected, but not confirmed.  As of this writing, version 89b is
  the latest official release.


  Please be aware that the PKZip v2.0B hack reported in the hack
  section of this report could be a Trojan.  According to the report
  filed in the VIRUS_INFO echo by Fred Towner, the archive (an ARJ
  archive, no less(!)) had these files in it:

        PKZIP20B.EXE
        UNKNOWN.NFO
        MUSTREAD.COM (archived with PKLITE)
        WATCHME!.EXE (archived with PKLITE)

  Fred was wise enough not to try and run any of these programs, so
  Trojan activity has not been confirmed.  Fortunately, the PKZ201
  hack appears to be nothing more than a hack of the 1.93 Alpha
  release.  Some relief, but a hack is a hack.


  Other previously reported Trojans/Droppers:

  Filename        Claimed use/Actual activity/Reporter(s)
  ------------    ---------------------------------------------------
  OCEAN.ZIP       From the BBS description: "Wonderful Game, Reward for
  PLANTS.ZIP      the person who conquers it 1 time, Good luck, how does
  RAINBOW.ZIP     30,000 bucks sound to you if you break the pattern, try
                  this game, it is wonderful, waht a challenge, bet you
                  can't break the pattern. $50, 000 if you do it twice."
                  Actually a compiled batch file that tries to erase all
                  files on your C: drive.  From Richard Dale (1:280/333).

  Obnoxious       "Tetris" clones for the Macintosh - actually droppers
    Tetris        of the MBDFA virus.  Via Paul Ferguson (1:109/229)
  Tetriscycle     in the VIRUS_INFO echo.
  Ten Tile Puzzle

  PSI3.ARJ        Passing itself as the LHA Archiver, version 3.00.  It
                  destroys your partition table, boot sector, and parts
                  of FAT 1 and FAT 2.  From Nemrod Kedem (2:403/138).

  ZAPPER15.*      PSI3, mentioned above, recommends an "antivirus"
                  program called ZAPPER15.* to remove a virus called
                  "PSQR".  ZAPPER15 is another Trojan which overwrites
                  your hard disk's boot sector with random garbage data
                  from memory.  It contains no viral code.  Also from
                  Nemrod Kedem (2:403/138)

  GREYSCAL.*      Claims to be a monitor adjustment utility - actually
                  a dropper - infects files on your hard drive with the
                  FISH virus through the README.EXE file in the archive.
                  Not detectable by any scanner.  From Bill Logan
                  (1:300/22).

  MONOP3-0.*      Supposed to be Monopoly for Windows.  Contains
                  FORMAT.COM from DOS 4.01 and STACKEY v2.1 (renamed as
                  MONOP1.COM and MONOPOLY.COM and invoked by a batch
                  file called README!!.BAT).  Will try and format your
                  hard drive - a volume label on your HD will thwart
                  this one.  From Derek Vanmunster (1:229/418).

  ================================================================

                    Pirated Commercial Software

  Program                 Archive Name(s)       Reported By
  -------                 ---------------       -----------
  Above Disk v3.00A       EXP-MEM.*             Dale Woloshin (1:163/211.3)
                                                and Wolfgang Fritz

  BeetleJuice (game)      BJUICE.*              Alan Hess (1:261/1000)
                          BJ.*                  Bill Blakely
                                                  (RIME Shareware echo)

  Commander Keen part 2   #2KEEN.*              Steve Hodsdon (1:132/119.12)

  Double Disk             DDISK214.*            Ronald McGill (1:167/149)

  Duke Nukem parts 2 & 3  DUKEZIP2.EXE          Steve Hodsdon (1:132/119.12),
                          #2DUKE.*              Craig Demarsh (1:260/213),
                          DUKEZIP3.EXE          and Hal Thompson (1:353/220)

  Eagle's Nest (game)     Unknown               Mike Headley (1:362/112)
                          (not in wide distribution)

  Fastback Plus v2.0      FBPL200.*             Bogie Bugsalewicz (1:115/738)

  Flashlink MNP Emulator  FLASHLNK.*            Several

  LotusWorks v1.0         LWORKS.*              Brian Luker (1:167/149)

  Mac-in-Dos              CLINK.*               Stuart Kremsky (1:125/28)
                     (not the SEALink protocol)
                          MAC-DOS.*             Ron Bass (1:128/13.3)
                                                Leslie Meehan, original
                                                  reporter (unknown)

  Microsoft Mouse Driver  MOUSE810.*            Bat Lang (1:382/87)

  MTE MNP Emulator        MTE215.*              Bat Lang (1:382/87)
                          MTE210E.*
                          MTE210F.*
                          MTE210G.*
                          MX5.*                 Wolfgang Fritz
                          MX6.*

  Optune                  OPTUNE.*              Bat Lang (1:382/87)
                          OPTUNE11.*
                          OPTUNE12.*            Jeff Dunlop (1:203/16)

  QModem 5.0              QM50.*                Daniel Hagerty (1:208/216)

  SimCGA                  SIMCGA40.*            Joe Morlan (1:125/28)
                          SIMCGA41.*

  SIMCITY                 SIMCITY.*             Mark Visser

  Solitare Royale         SOLITRYL.*            Dan Brady (1:282/108)
                          SOLIT.*               Bud Webster (1:264/165.7)

  Spot (7-Up game)        SPOT.*                Steve Hodsdon (1:132/119.12)

  Squish 2.1              SQUISH21.*            Several
                                                (verified by Joe Morlan)

  Tunnels of Armageddon   TUNNELS1.*            Wolfgang Fritz (1:249/140)
                          TUNNELS2.*

  ================================================================

                  ?????Questionable Programs?????

| Ken Whiton (1:132/152), The Hack Report's gateway to the WildNet
| network, has relayed a post from Tony Blair in the WildNet
| Shareware echo.  Tony found a file called AUTO48.*, which is
| supposed to be the latest version of AutoMenu.  However, he called
| the support BBS and only found version 4.7.  I would really
| appreciate some information on this, if anyone has any.


| BiModem is the subject this time, but the situation doesn't quite
| fit into any of the other categories of this report.  A few users
| have seen a version called BIMOD125.* floating around, and
| wondered if it was a hack.  Steve Baker (1:114/116.0) called the
| support BBS and verified your Hack Squad's information: v1.25 is a
| closed beta.  Version 1.24 is the latest public release.  This
| information was also verified by the Hack Squad (in lurk mode over
| in the BIMODEM echo) through a message posted by Michael Ingram
| (1:114/151).  In short, if you see BIMOD125, delete it - it's a
| beta that shouldn't be out yet.


| I still have no further confirmation of MTG2400, reported by
| Zach Adam of 1:2200/103.  The description says this program will
| run a 2400bps modem like a 4800bps modem, which sounds a bit like
| the MTE program listed in the Pirated Commercial Software section.
| Any information would be appreciated.

  ================================================================

                           Clarification

| Last week, Bob Keegan (1:371/26.20) reported that a BBS utility
| called XLIST214.* was a possible Trojan/hack.  The sysmptoms he
| reported (e.g., strange messages, deleted files) were verified
| by another user.  Other (extremely helpful and very much appreciated)
| users decided to put this to the test and/or report their own
| experience with the file.  They were able to reproduce the symptoms,
| and found that the strange messages were in fact undocumented
| messages placed in the file by the author.  Bob Keegan later checked
| with the author, Per Holm, about his symptoms, and verified that
| they will occur when the program is run on a hard disk with very low
| remaining disk space.  In other words, the file is not a Trojan
| or a hack.  Bob posted his correction in the SHAREWRE echo on
| Friday, April 3.

| My thanks go out to those who tested the file and reported their
| results.  Also, I thank and applaud Bob Keegan for posting his
| correction in the echo.  It takes guts to admit a mistake, even a
| well-intentioned one.  Nobody's perfcet.

  ****************************************************************

                             Conclusion

  If you see one of these on a board near you, it would be a very
  friendly gesture to let the SysOp know.  Remember, they can get
  in just as much trouble as the fiend who uploads pirated files,
  so help them out if you can.


                      ***HACK SQUAD POLICY***

  The intent of this report is to help SysOps and Users to identify
  fraudulent files.  To this extent, I give credit to the reporter
  of a confirmed hack.  On this same note, I do _not_ intend to "go
  after" any BBS SysOps who have these programs posted for d/l.  The
  Shareware World operates best when everyone works together, so it
  would be counter-productive to "rat" on anyone who has such a file
  on their board.  Like I said, my intent is to help, not harm.
  SysOps are strongly encouraged to read this report and remove all
  files listed within from their boards.  I can not and will not
  take any "enforcement action" on this, but you never know who else
  may be calling your board.  Pirated commercial software posted for
  d/l can get you into _deeply_ serious trouble with certain
  authorities.

  Updates of programs listed in this report need verification.  It
  is unfortunate that anyone who downloads a file must be paranoid
  about its legitimacy.  Call me a crusader, but I'd really like to
  see the day that this is no longer true.  Until then, if you
  _know_ of a new official version of a program listed here, please
  help me verify it.

  On the same token, hacks need to be verified, too.  I won't be
  held responsible for falsely accusing the real thing of being a
  fraud.  So, innocent until proven guilty, but unofficial until
  verified.

  Upcoming official releases will not be included or announced in
  this report.  It is this Co-Moderator's personal opinion that the
  hype surrounding a pending release leads to hacks and Trojans,
  which is exactly the opposite of what I'm trying to accomplish
  here.

  If you know of any other programs that are hacks, bogus, jokes,
  hoaxes, etc., please let me know.  Thanks for helping to keep
  shareware clean!

Lee Jackson, Co-Moderator, FidoNet International Echo SHAREWRE (1:382/87)
