  ========================================================================
                                    ||
  From the files of The Hack Squad: ||  by Lee Jackson, Co-Moderator,
                                    ||  FidoNet International Echo SHAREWRE
          The Hack Report           ||  Volume 1, Number 19
           for July 1992            ||  Report Date: July 3, 1992
                                    ||
  ========================================================================

  Welcome to the nineteenth issue of The Hack Report.  This is a series of
  reports that aim to help all users of files found on BBSs avoid
  fraudulent programs, and is presented as a free public service by the
  FidoNet International Shareware Echo and the author of the report, Lee
  Jackson (FidoNet 1:382/87.4).

| Last month was, to say the least, interesting.  Another hard disk hoax
| was seen, another communication package from MagicSoft was pirated, and
| your Hack Squad finally gets his hands on the granddaddy of all hoaxes.
| Also, a new group of people dedicated to stamping out fraud makes its
| debut: The HackWatchers.  Thanks to everyone who has helped put this
| report together, and to those that have sent in comments and suggestions.


| HOW TO CONTACT THE HACK SQUAD:

| If you have a report or comment, I can be reached through any of the
| following systems and/or networks:

      The ECS BBS at (512)328-6923  (leave message in the ECS_GENERAL area)
      FidoNet:
         FidoNet International Echos SHAREWRE and PDREVIEW
         NetMail Address   1:382/87.4
      RIME Address         MAH (Modem Addictus Hospital (512)443-8941)
      CompuServe:
         IBM BBS Forum (GO IBMBBS)
         Mail Address   76040,2743
|     Internet:
|      Lee Jackson on "The Middle of Nowhere", Kyle, TX  1:382/87.4@fidonet
|        ljackson@mdf.fidonet.org
|        Hack Report notices to hackreport@mdf.fidonet.org

| THE HACKWATCHERS:

| If you are unable to contact me directly, you should try and contact one
| of The HackWatchers.  This is a small group of people who cover other
| parts of the world with their eyes wide open for hacks and other frauds.
| They may be reached as follows:

|    HackWatcher           Network/Conference/Other Info
|    ===============       =============================
|    Frank R Pizer         FidoNet Zone 5 (South Africa)
|                          FidoNet NetMail Address 5:7102/713
|
|    Richard Steiner       RIME (RelayNet) Shareware Conference
|                          FidoNet NetMail Address 1:282/85
|
|    Ken Whiton            WildNet! Shareware Conference
|                          FidoNet NetMail Address 1:132/152

  NOTE TO SYSOPS: The Hack Report may be freely posted as a bulletin on
  your BBS, subject to these conditions:

             1) the latest version is used,
             2) it is posted in its entirety, and
             3) it is not altered in any way.

  NOTE TO OTHER READERS: The Hack Report (file version) may be freely
  uploaded to any BBS, subject to the above conditions, and only if you do
  not change the filename.  You may convert the archive type as you wish,
  but please leave the filename in its original HACK????.* format.  The
  Hack Report may also be cross-posted in other networks (with the
  permission of the other network) as long as it meets the above conditions
  and you give appropriate credit to the FidoNet International Shareware
  Echo (and the author <g>).

  The idea is to make this information available freely.  However, please
  don't cut out the disclaimers and other information if you use it, or
  confuse the issue by spreading the file under different names.  Thanks!

  DISCLAIMER: The listings of Official Versions are not a guarantee of the
  files' safety or fitness for use.  Someone out there might just be
  sick-minded enough to upload a Trojan with an "official" file name, so
  >scan everything you download<!!!  The author of this report will not be
  responsible for any damage to any system caused by the programs listed as
  Official Versions, or by anything using the name of an Official Version.

  Now that the Draconian stuff is out of the way, let's get to the report!

  ************************************************************************

                              Hacked Programs

  Here are the latest versions of some programs known to have hacked copies
  floating around.  Archive names are listed when known, along with the
  person who reported the fraud (thanks from us all!).

   Program              Hack(s)            Latest Official Version
   -------              -------            -----------------------
   Aliens Ate           !ALIENS                    K6DEMO
    My Babysitter
      Reported by:  Christopher Baker (1:374/14)

   AutoMenu             AUTO48                     AUTO47
      Reported by:  Tony Blair (WildNet)
                via Ken Whiton (1:132/152)
      Verified by Marshall Magee, Magee Enterprises, Inc.

   CatDisk              CDISK510                   CDISK621
                        CDISK530
                        CDISK661
      Reported by:  Jeff Kaplow (1:120/234)

   CompuShow            CSHOW801                   CSHW844A
                        CSHOW831
                        CSHOW851
      Reported by:  Paul Brazil
      (Note:  Any version ending with a B, such as CSHW841B, is _not_
       a shareware version.  This is the enhanced version received
       with the user's registration and is not to be distributed. 
       Consider all B archives to be pirated copies.)

   Las Vegas EGA Casino (unknown)
      Reported by the author, Diana Gruber, in the ILink net,
      relayed by Richard Steiner (1:282/85)
      (Note:  a version of this program sold through Gemini
       shareware outlets with the title screen "Special GEMINI
       game disk" and a version calling itself the "Ledyard$
       EGA Casino" have been distributed.  No archive names
       have been supplied yet.)

   LHA Archiver         LHA214                     LHA213
      Reported by: Patrick Lee (RIME address RUNNINGB)

   List                 LIST8                      LIST76B
                        LIST18
      Reported by: The Hack Squad (from the Buerg BBS)

   Math Master          MATHMSTR                   M-MST301
      Reported by: James Frazee (1:343/158)

   PKZip                PKZIP120                   PKZIP110
                        PKZIP20B
                        PKZIP_V2.EXE
      Reported by: Mike Burger (WildNet)
               via Ken Whiton (1:132/152)
      Reported by: Fred Towner (1:134/73)
                        PKZ201.ARJ
      Reported by: Frank Pizer (5:71/0)
                        PKZ201.ZIP
                        PKZ201.EXE
      Reported by: Jim Westbrook (1:382/29)
                        PKX201.EXE
      Reported by: Bill Logan (1:300/22)
|                       PKZ210F.EXE
|     Reported by: Bert Bredewoud (2:281/703)
|                       PKZIPV2
|     (Claims to be v2.2 of PKZip - reported via PKWare Tech Support)
                        PKUNZIP.COM
      Reported by: Harold Stein, via Ken Whiton

   QEdit Advanced       XEDIT                      QEDIT215
      Reported by: Sammy Mitchell, Author
      (thanks to Rand Nowell and Joe Morlan for relaying the report)
|                       QEDIT500.*
|     Reported by: Onno Tesink (ILink, via Richard Steiner, 1:282/85)

   Telegard 2.9E Alpha  TG29EALP                   Telegard 2.7
      Reported by: Karen Maynor (1:3640/5)
      (Found on the NightOwl CD-ROM disc version 5.0)

   Telix                Telix v3.20                Telix v3.15
                        Telix v3.25
      Reported by: Brian C. Blad (1:114/107)
                   Peter Kirn (WildNet, via Ken Whiton)
                        Telix v4.00
                        Telix v4.15
      Reported by: Barry Bryan (1:370/70)
                        Telix v4.25
      Reported by: Daniel Zuck (2:247/30,
               via Chris Lueders (2:241/5306.1)
                        MegaTelix
      Verified by Jeff Woods, Exis, Inc., in the TELIX echo,
      who also states that there will be _no_ release titled
      Telix 4.0.  He states the next release of Telix will be
      under a completely new name, which has not been decided
      upon yet.  Any version with a number higher than 3.15
      can be considered a confirmed hack, unless reported
      here otherwise.

   TheDraw              TDRAW430                   TDRAW451
                        TDRAW500
      Reported by: Ian Davis, Author
                        TDRAW550
      Reported by: Steve Klemetti (1:228/19)
                        TDRAW600
      Reported by: Hawley Warren (1:120/297)
                        TDRAW800
      Reported by: James Carswell (1:153/775)

   Turbo Antivirus      Version 9.00b              Version 8.10
                        Version 9.01a
                        (Archive names unknown)
      Reported by: Thomas Ruess (2:246/24)

|  ViruScan             SCAN92.*                   SCAN93
|     Reported by: Don Dunlop (1:153/715)

   X00 Fossil           X00V130                    X00V124
                        X00V130J                   (also official is
                                                    X00V149A, a beta
                                                    test of an OS/2 ver.)

  *** More Hacks

  Chris Lueders (2:241/5306.1) reports that a file calling itself VPIC50DT
  is a hack of version 4.5 of the VPic graphics file viewer.  Specifically,
  the 5.0dt file ("dt" indicates a German language edition, per Chris) is a
  hack of the English version 4.5.  At the time of the report, version 4.9
  was the latest official release, but now a legitimate version 5.0 is out.
  Be careful, then: if your copy of VPIC50 starts up in German, delete it.


  Finally, here's one I'm not sure how to handle: It's a hack, but it
  appears to be a hack of a commercial program.  Frank Pizer (5:71/0) has
  found a hack of a program called BitFax.  The hack, calling itself
  ZIPFAX.ZIP (at 146320 bytes), has been altered so that all occurrences of
  the word Bit with the word Zip.  The archive contains configuration files
  with the words "Technopoint - Avi Miller" in them.  Thanks to Frank for
  the report from Zone 5: let's hope the rest of us can keep it from
  spreading beyond there.

  =======================================================================

                                Hoax Alert:

| After all these months of reporting on it from afar, your Hack Squad has
| finally obtained a copy of the granddaddy of all hoaxes, XTRATANK.  I
| found it on a board in my own hometown that has no echomail access, so
| they weren't familiar with The Hack Report (weren't, that is - they are
| now <g>).

| I have sent a copy of the file to Bill Logan, an agent of McAfee
| Associates, for possible testing, if he agrees and has time.  If so, we
| will _finally_ have an expert opinion on the status of this file.  Stay
| tuned!

| Just so that those of you in North America won't feel alone, HackWatcher
| Frank Pizer forwarded a report from Johan Erlank (5:7101/6.1) that
| XTRATANK has been seen in a South African shareware distribution store
| and in an article in a South African computer magazine.  Bad news travels
| fast, I guess. :-)

| Also, HackWatcher Ken Whiton forwarded an interesting opinion from Jon
| Jasiunas in the WildNet!  Shareware Conference.  Jon said that what he
| had read about XTRATANK indicates that the author never really intended
| for it to do what it claims.  He guesses that someone other than the
| author released the file with the claim of doubling your hard drive
| space.  If true, that would explain a lot.

  *** The Fitzgerald Test

  Until we hear from Mr. Logan, here is the now-famous Fitzgerald Test,
  devised by Tim Fitzgerald of 1:3800/18.0.  Try this if you think you have
  managed to get XTRATANK to work on your system.  Follow these simple
  steps:

      1. Run CHKDSK and write down the free space it reports as free.
      2. Do a DIR command and write down what XTRATANK reports.
      3. Copy any text file to a new text file.
      4. Repeat steps 1 and 2, and compare.

  You will see that XTRATANK reports that twice as much disk space is taken
  up by the new text file.  Tim concludes that XTRATANK fools you into
  thinking that it gives you more space by doubling what the DOS DIR
  command reports.  If you get different results, _please_ send them to me
  immediately!  Until then, consider XTRATANK a hoax that doesn't work.


| Now, the latest hoax out in BBSland.  Samuel H. Smith uploaded a file to
| my BossNode, Mark Evans at The ECS BBS (1:382/87), that was a warning
| about a file called MAXRES.ARJ that claims to be written by Mr. Smith.
| According to Mr. Smith, the program was _not_ written by him.

| The file claims to "check your graphics interface and show you
| resolutions of your interface card." The file is an elaborate hoax, down
| to having the correct address and phone number for Mr.  Smith.  According
| to Kim Miller (1:103/700), her test of the program showed that it
| accessed the A: drive of her computer and halted if no disk was found.
| She put a blank disk in the drive, allowed it to access, and received a
| message showing her "max resolution" as 480x640.  She has not yet seen
| any damage to her system.

| Mr. Smith's warning states that the file is a Trojan, but also states
| that he has not run the program.  For now, I'm classifying this as a
| hoax, but I'll reclassify it as necessary if more information comes in.


  Other previously reported hoaxes:

  Filename       Claimed use/Actual activity/Reporter(s)
  ------------   --------------------------------------------------------
  2496.*         This, and all files that claim to run a 2400 bps
                 modem at 9600 or 14400 bps, are hoaxes.  If you
                 follow their instructions, you will have a 0 bps
                 modem.  Reported by several people.

  AMIGA.*        Claims to allow IBM/Clones to read Amiga Workbench
                 Disks: displays a picture of an Amiga Workbench disk
                 on your screen, then spins your A: drive and locks
                 your system.  From Suriya Matsuda, Jacob Kanafoski
                 (1:3613/4), Derek Vanmunster (1:229/418), and Jeff
                 Hancock (1:3600/7).

  BIMOD126.*     Claims to be version 1.26 of BiModem - actually v1.24
                 renamed and re-archived.

  =======================================================================

                              The Trojan Wars

| If there was ever a need for a reason to keep your eyes open for Trojans,
| this past month would serve as a perfect example.  The folks out there
| writing these things are getting sneakier all the time.  So, take a deep
| breath, cover your children's eyes, and read on for details on this
| month's onslaught.


| By far, the nastiest looking one seen this month was another program that
| claims to increase your hard drive capacity.  This file, reported by Dave
| Doehrman (1:236/21) in the FidoNet PDREVIEW echo, is called COMPILER.ARJ.
| It claims to be as good as Stacker without any loss of speed.

| Here is an excerpt from the documentation provided with the file:

| ________________________________________________________________________

|                           The Compiler
|                                      By: Dan Rhodes
| ________________________________________________________________________

| The Compiler is a Freeware Version of Stacker.  It was released on May
| 13,1992.  All you need to do is put Compiler.Bat into the your root
| directory and let her go.  The Compiler Formats sectors of your HD and
| compiles them after it copy that sector to another sector which causes
| better efficiency.  There will be No Speed Reduction at all.  Check our
| Q&A .TXT file if you have any question or call 1-800-999-4739 or call The
| Chamber BBS at 313-653-8901.  Thank you for using The Compiler!

| (end excerpt)

| Dave used a file viewer on the executables and found text strings such as
| "DEL C*.*", "DEL A*.*", and some others that he didn't elaborate on but
| scared him enough to keep him from running the program.

| Your Hack Squad, always curious, called the 1-800 number listed in the
| text file and very quickly discovered it was a "phone sex" number and not
| a customer support line.  Bruce Diamond (1:130/47) called the other phone
| number and found it to be disconnected.

| All in all, this looks like a very deceptive attempt to trash your
| system.  I'd avoid it until someone gets a copy to McAfee or another
| testing lab and gives it a good going over.


| A file was sent to Hack Central Station by Michael Kerr (1:309/7), called
| NPV2.ZIP.  This file contains something called the "Non-Programmer's
| Virus." According to Michael, the file is unusual in that the virus
| source code is contained in the file.

| To compound matters, the file contains an infected version of LIST.COM
| which is not caught by McAfee's SCAN.  Michael, like many of us, fires up
| LIST right after unarchiving a file to read the docs, so the infected
| version executed before the one on his path, and boom!  His system was
| infected.

| Michael says that the program is supposedly an aid in testing anti-viral
| software.  With this in mind, a copy of this file has been sent to Bill
| Logan (1:300/22) for testing.  Results of his tests will be reported here
| as soon as they arrive.


| Michael Toth (1:115/439.7) reports that a "terrorist" uploaded a file to
| his board called RAMBO.ZIP.  The file was 290 bytes long, and contained
| two files called CLOCK$ and PRN.  For those of you not too familiar with
| the internals of MS-DOS, these are device names that are reserved by DOS
| and cannot be used as filenames.  Any attempt by a program to create a
| file with the same name as a device opens the device instead, according
| to the Microsoft MS-DOS Programmer's Reference, page 55.  So, if you try
| to unzip this archive, the real-time clock and your printer are opened as
| devices when your unzipping program tries to create the above named
| files.  Archive viewers or _anything_ else that opens the archive will
| have the same effect.

| Michael did find a scan string in the file, which was "Hi Carl!" (minus
| the quotation marks), but not until his system was hit.  Michael's
| printer was offline at the time, but his clock was affected, setting the
| system time to 32:32:32 in the year 2002.  As Michael says, this is a
| very crafty way of doing a Trojan, and not a nice thing to have hit your
| system.


| Bill Lambdin (Intelec Virus Conference, via Arthur Shipkowski
| (1:260/213.2)), reports a version of a file called TIME.EXE that wipes
| out all partitions of your hard drive.  Some discussion took place in the
| FidoNet International Echo SHAREWRE after this was reported in The Hack
| Update.  It would seem that in most cases, the internal DOS command TIME
| would take precedence over this file when trying to execute it, but there
| are ways (some possibly accidental) to get it to invoke.

| Another file called TIME.* has already been reported here, but this one
| seems to be different.  No further information was provided.  Keep an eye
| open for anything with this filename - it seems to be a bearer of bad
| news.


  Dan Christman (1:520/519) reported that there is a version of TheDraw
  that contains "several viruses." He says to watch for a file within the
  archive called THEDRAW.PCK.  This file, as far as my experience goes, is
  only created after the program is initially executed and is not part of
  the official archive.  Dan gave no filename for this dropper, but be on
  the lookout for an archive with the THEDRAW.PCK file in it.

  Just for the record (once again), the latest official release of TheDraw
  is v4.51.


  Please be aware that the PKZip v2.0B hack reported in the hack
  section of this report could be a Trojan.  According to the report
  filed in the VIRUS_INFO echo by Fred Towner, the archive (an ARJ
  archive, no less(!)) had these files in it:

        PKZIP20B.EXE
        UNKNOWN.NFO
        MUSTREAD.COM (archived with PKLITE)
        WATCHME!.EXE (archived with PKLITE)

  Fred was wise enough not to try and run any of these programs, so
  Trojan activity has not been confirmed.


  Other previously reported Trojans/Droppers:

  Filename        Claimed use/Actual activity/Reporter(s)
  ------------    -------------------------------------------------------
| ARJ240.EXE      Supposed "latest version" of the popular Archiver by
|                 Robert Jung (ARJ).  This is a dropper of the FISH virus,
|                 reportedly with a "secure envelope." Latest official
|                 version of ARJ is 2.30.  Reported by Hazel Clarke
|                 (1:134/68) via Ken Miller (1:134/111).

| CUBULOUS.*      No claim reported for this file - apparently contains
|                 a dropper of the REX virus (detected by SCAN v91 and
|                 higher).  Reported by Bill Arlofski in the CNET Spitfire
|                 Support Conference, forward by several through Mark
|                 Wurlitzer (1:294/9).

  GREYSCAL.*      Claims to be a monitor adjustment utility - actually
                  a dropper - infects files on your hard drive with the
                  FISH virus through the README.EXE file in the archive.
                  Not detectable by any scanner.  From Bill Logan
                  (1:300/22).

  MONOP3-0.*      Supposed to be Monopoly for Windows.  Contains
                  FORMAT.COM from DOS 4.01 and STACKEY v2.1 (renamed as
                  MONOP1.COM and MONOPOLY.COM and invoked by a batch
                  file called README!!.BAT).  Will try and format your
                  hard drive - a volume label on your HD will thwart
                  this one.  From Derek Vanmunster (1:229/418).

  Obnoxious       "Tetris" clones for the Macintosh - actually droppers
    Tetris        of the MBDFA virus.  Via Paul Ferguson (1:109/229)
  Tetriscycle     in the VIRUS_INFO echo.
  Ten Tile Puzzle

  OCEAN.ZIP       From the BBS description: "Wonderful Game, Reward for
  PLANTS.ZIP      the person who conquers it 1 time, Good luck, how does
  RAINBOW.ZIP     30,000 bucks sound to you if you break the pattern, try
                  this game, it is wonderful, waht a challenge, bet you
                  can't break the pattern. $50, 000 if you do it twice."
                  Actually a compiled batch file that tries to erase all
                  files on your C: drive.  From Richard Dale (1:280/333).

  PSI3.ARJ        Passing itself as the LHA Archiver, version 3.00.  It
                  destroys your partition table, boot sector, and parts
                  of FAT 1 and FAT 2.  From Nemrod Kedem (2:403/138).

| QUICKEYS.*      Claims to increase keyboard speed - turns out to be the
|                 actual executable file of the BURGER virus.  The virus
|                 file is called QUICKEYS.COM and is 542 bytes long.
|                 This is not to be confused with the PC Magazine Utility
|                 of the same name.  Reported by Jay Siegel (1:153/151).


  SCAN87.*        Suspected of Trojan activity, but not confirmed.  The
| SCAN88.*        latest official release is SCAN93.  Reported by
  SCAN96.*        several.

  TGSEC16.*       Trojan version of Telegard Security Package - both
                  executables in the archive will infect your system
                  with the Dark Avenger virus, and the text files show
                  you how to ease access to your system by hackers instead
                  of prevent access.  By Scott Raymond, author of the
                  real package (latest official version is TGSEC17.*).

| TIME.*          Possible dropper - contains the scan string "Another
|                 Fine Virus By Ace Hacker" in the file TIME.EXE.  From
|                 the ACCESS Net Virus Forum by James McKenzie (1:309/31).
|                 Also see the report in the beginning of this section
|                 about a different TIME program.

| TMFIX.*         Claims to fix a problem with the dialing directory used
|                 by the communication program Telemate.  Formats your hard
|                 drive (or at least part of it) instead.  Reported by
|                 Brian Hess (WildNet), via HackWatcher Ken Whiton.

  VPIC47.*        One circulating version of this seems to contain the
                  Dark Avenger virus, "split" so that no scanner can pick
|                 it up.  Get the latest version of VPic, VPIC50, to avoid
                  this.  From Tim Tim Sawchuck and Jeff Simmons in the
                  WildNet VIRUSES_MN conference.

  WLFCHEAT.*      Claims to be a "cheat" file for the Apogee/Id game
                  Wolfenstein-3D.  Actually wipes out your hard drive's
                  boot sector and trashes the File Allocation Tables.
                  Not to be confused with WLF1CHT, a legitimate "cheat"
                  file written by Michael P. Hoffman.  Reported by
                  R. Wallace Hale, SysOp of the Driftnet BBS
                  (PC Virus Research Foundation), via Clayton Manson
                  (1:3612/140).

  ZAPPER15.*      PSI3, mentioned above, recommends an "antivirus"
                  program called ZAPPER15.* to remove a virus called
                  "PSQR".  ZAPPER15 is another Trojan which overwrites
                  your hard disk's boot sector with random garbage data
                  from memory.  It contains no viral code.  Also from
                  Nemrod Kedem (2:403/138)

  ========================================================================

                        Pirated Commercial Software

  Program                 Archive Name(s)       Reported By
  -------                 ---------------       -----------
  Above Disk v3.00A       EXP-MEM.*             Dale Woloshin (1:163/211.3)
                                                and Wolfgang Fritz

  Backgammon Royale       BGROYALE.*            Shakib Otaqui (2:440/74)
                          BGROYDOX.*

| Bargames                BARGAMES.*            Scott Lewis (1:107/607)
|  (game from Accolade)

  BeetleJuice (game)      BJUICE.*              Alan Hess (1:261/1000)
                          BJ.*                  Bill Blakely
                                                  (RIME Shareware echo)
                          BTLJWC.*              the Hack Squad
                                                  (1:382/87.4)

| BitFax 1.22B            Unknown               Antonio Rezende (RIME)

  Commander Keen          #2KEEN.*              Steve Hodsdon (1:132/199)
   (parts 2 and 3)        #3KEEN.*              Harold Stein
                                                 (via Ken Whiton, 1:132/152)

  Double Disk             DDISK214.*            Ronald McGill (1:167/149)

  Duke Nukem parts 2 & 3  DUKEZIP2.EXE          Steve Hodsdon (1:132/199),
                          #2DUKE.*              Craig Demarsh (1:260/213),
                          DUKEZIP3.EXE          and Hal Thompson (1:353/220)
                          DUKETRIL.*            Harold Stein (WildNet)
   (also under various other names - only the first game in the trilogy
    is shareware:  #2 & #3 are for registered users only and are pirated.)

  Eagle's Nest (game)     EAGLE.*               Mike Headley (1:362/112)
                                                Frank R Pizer (5:71/0)

  Fastback Plus v2.0      FBPL200.*             Bogie Bugsalewicz (1:115/738)

  Flashlink MNP Emulator  FLASHLNK.*            Several

  Gauntlet (game)         GAUNTLET.*            Cimarron Mittlesteadt
                                                 (via Ken Whiton, WildNet)

  GSZ                     GSZ0410.*             Arthur Taber (1:125/28)
                                                 (via Stuart Kremsky)
|                         GSZ1214R.*            Harold Stein,
|  NOTE: GSZ is a shareware program,             via Ken Whiton (1:132/152)
|  but these particular archives were
|  the registered versions.

| KDREAMS                 KDREAMS               John Van Eekelen (2:500/228)
|  (game from Softdisk)

  LotusWorks v1.0         LWORKS.*              Brian Luker (1:167/149)

  Mac-in-Dos              CLINK.*               Arthur Taber (1:125/28)
                     (not the SEALink protocol)
                          MAC-DOS.*             Ron Bass (1:128/13.3)
                                                Leslie Meehan, original
                                                  reporter (unknown)
                          MACON-5.*             Kimberly Avery (1:324/278)

  Microsoft Mouse Driver  MOUSE810.*            Bat Lang (1:382/87)

| MTE MNP Emulator        4800BAUD.*            George Staikos,Trenton,ON,
|                                                via Mark Evans (1:382/87)
                          MTE215.*              Bat Lang (1:382/87)
                          MTE210E.*
                          MTE210F.*
                          MTE210G.*
                          MX5.*                 Wolfgang Fritz
                                    Verified by Steve Lieberman
                                             of MagicSoft, Inc.
                          MX6.*

| MTEZ (MagicSoft)        MTZ115B1.*            Kim Miller (1:103/700)

  Optune                  OPTUNE.*              Bat Lang (1:382/87)
                          OPTUNE11.*
                          OPTUNE12.*            Jeff Dunlop (1:203/16)

  Paganitzu part 2        #2PAGA.*              Harold Stein
                                                 (via Ken Whiton, 1:132/152)

  QModem 5.0              QM50.*                Daniel Hagerty (1:208/216)
                          QMODEM50.*            Larry Owens (1:280/87)

  Rambo (game)            RAMBO.*               Cimarron Mittlesteadt
                                                 (via Ken Whiton, WildNet)

| Red Baron game          unknown               Nolan Taylor (1:157/537)
|   (by Dynamix)

  SimCGA                  SIMCGA40.*            Joe Morlan (1:125/28)
                          SIMCGA41.*
   NOTE: SimCGA went commercial with release 4.0, according to the
   publisher (via Joe Morlan).  Versions prior to this were copyrighted
   free programs.

  SIMCITY                 SIMCITY.*             Mark Visser

  Solitare Royale         SOLITRYL.*            Dan Brady (1:282/108)
                          SOLIT.*               Bud Webster (1:264/165.7)

  Spot (7-Up game)        SPOT.*                Steve Hodsdon (1:132/199)

  Squish 2.1              SQUISH21.*            Several
                                                (verified by Joe Morlan)

  Supaplex                Unknown               Kevin Donald (1:123/54)
                                                Rick Rosinski (1:239/1004)
                                                Dennis Matney (1:230/12)

| SuperStor               SSTOR204.*            John Van Eekelen (2:500/228)

  Tetris (the original)   #1TETRIS.*            Harold Stein (WildNet)

| Tidbits                 TIDBITS.*             Art Taber
|  (game? from Softdisk)                         via Stuart Kremsky
|                                                 (1:125/28)

  Top Gun                 TOPGUN.*              Cimarron Mittelsteadt
                                                 (WildNet, via Ken Whiton)

  Tunnels of Armageddon   TUNNELS1.*            Wolfgang Fritz (1:249/140)
                          TUNNELS2.*

| VGA-Copy v4.6           VGACPY46.*            Bert Bredewoud (2:281/703)
|  (Registered Copy)

  ========================================================================

                      ?????Questionable Programs?????

| This is a strange one that doesn't fit anywhere else.  Bert Bredewoud
| (2:281/703) reports that a file called ARJREG.ARJ has been seen in his
| area.  This program "registers" your copy of ARJ v2.30.  This file has
| also been seen by John Van Eekelen (2:500/228) and Jonathan Heiliger (in
| the Intelec Virus Conference, via Arthur Shipkowski (1:260/213.2).
| Jonathan reports the following archive information:

| Searching ZIP: ARJ_REG.ZIP

|  Length  Method  Size  Ratio   Date    Time   CRC-32  Attr  Name
|  ------  ------  ----- -----   ----    ----   ------  ----  ----
|    5769  Stored   5769   0%  01-01-92  15:26  8896cccc --w  ARJ_REG.EXE
|  ------         ------  ---                                 -------
|    5769           5769   0%                                       1

| However, Mr. Van Eekelen reports the following info on the file that he
| saw:

| Filename     Original Compr Ratio DateTime modified CRC-32   AttrBTPMGVX
| ------------ -------- ----- ----- ----------------- -------- -----------
| REGISTER.DOC     1282   684 0.534 92-03-14 23:07:20 F652513E A--WB 1
| REGISTER.EXE    12492  8753 0.701 92-06-06 18:06:00 1478DCAC A--WB 1
| ------------ -------- ----- -----
|     2 files     13774  9437 0.685

| It is possible that there are two separate ARJ cracks out there, or one
| with a compressed executable version and a non-compressed version.  this
| information.  Most programs of this type have been dangerous in that they
| can corrupt the original file they claim to "register." Also, they're
| downright wrong to have in the first place.  Be fair to Mr. Jung and pay
| your registration fee: it's safer.


| Another wierd one is a hack of Microsoft's HIMEM.SYS, reported by Joe
| Morlan (1:125/28).  This is not a shareware file, but the hack, calling
| itself HIMEM500.*, has been circulating on BBS systems local to him.  For
| the record, the file is a hack of HIMEM.SYS v3.07.  Someone apparently
| took a hex editor after it and changed the version numbers from 3.07 to
| 5.00.  Otherwise, the file is identical to v3.07, and will be reported as
| such by diagnostic software such as MSD (Microsoft Diagnostics).  A new
| HIMEM is just as tempting as a new TheDraw, so let's stomp on this one
| while it's still young.


| Here's another "crack" (guess it's time to add another wing to Hack
| Manor, eh?): Art Taber (via Stuart Kremsky, 1:125/28) reports a file
| called PUNICOM.*, which deactivates the shareware "beg" screens from
| Unicom 3.0c, a Windows comm program.  Art says the crack was "put out by
| a group of phreakers (phone system pirates) listing their BBS numbers -
| one in Canada, one near New York City - both of which were
| non-functional."

| EDITORIAL: I kind of wonder about reporting things like this in The Hack
| Report/Update.  On one hand, cracks should be prevented from spreading on
| BBS systems, and SysOps should be aware of the files so they can delete
| them.  However, some people will no doubt be tempted to find and use the
| crack based on the publicity it receives here.  I would like your opinion
| on this: please contact me via FidoNet NetMail (or via any of the methods
| listed in the introduction to this report) if you have any suggestions on
| how I should handle this.  SysOps _and_ users are encouraged to reply.
| Like I've said, we really do listen here at Hack Central Station!


| I received a message on The ECS BBS (1:382/87) from Patrick Pfadenhauer,
| who says he is 12 years old, about a file called EPW27.*.  He has an
| earlier release, EPW12, which he likes, so naturally he downloaded what
| he thought was the latest version.

| He said that the archive contained 4 new .COM files which were supposed
| to be "Drivers that must be loaded before you run the program," but which
| turned out to be virus droppers.

| The reason I have this in this section is that I have no idea what EPW12
| is really supposed to be, and I hope that someone can help out on this.
| I also have no information on what virii were in the .COM files.  If Mr.
| Pfadenhauer is reading this, or if anyone else can help, please contact
| me.


| Jan Welch (1:382/87) has reported in the FidoNet VIRUS echo a file called
| W3DEDIT.ZIP, which she claims is a Trojan that will attack your hard
| drive's boot sector.  At first glance, this looks like a renamed
| WLFCHEAT, but I can't be sure.  I've sent NetMail for more information,
| so be on the lookout and report anything you know about it, if you would.


  Steve Klemetti (1:228/19) has found an archive of the Apogee game
  Paganitzu (#1PAGA.ZIP) that may either be a hack or a corrupted archive.
  The file size is 281K, and the .EXE file within is 8K (vs 11K for the
  official archive.  Steve says the opening screens go by "too fast," then
  the program puts your hard drive in "a constant seek mode." The file
  passed viral scanning.  Like I said, this could just be a corrupt
  archive, but you never know.  Just be on the lookout for an archive that
  meets these specs, and avoid it.  The real thing is a pretty decent game,
  though, according to my 5-year old son, so don't avoid _all_ #1PAGA.*
  files just because of a bad version.

  While we're on the subject of Apogee games, there seems to be a constant
  state of confusion regarding the numbering system they use to identify
  shareware releases.  I have received information from Jay Wilbur
  (1:124/6300) of Id Software, who created Wolfenstein-3D and other games
  for Apogee, that would indicate that they release their games in
  trilogies and that the first game in each trilogy is the only one that is
  shareware.  Further, it seems that if a game spawns more than one
  trilogy, the same pattern applies (#1, #4, #7, etc.).  I'm still trying
  to get more info on this, so stay tuned.


  BiModem is the subject this time, but the situation doesn't quite fit
  into any of the other categories of this report.  A few users have seen a
  version called BIMOD125.* floating around, and wondered if it was a hack.
  Steve Baker (1:114/116.0) called the support BBS and verified your Hack
  Squad's information: v1.25 is a closed beta.  Version 1.24 is the latest
  public release.  This information was also verified by the Hack Squad (in
  lurk mode over in the BIMODEM echo) through a message posted by Michael
  Ingram (1:114/151).  In short, if you see BIMOD125, delete it - it's a
  beta that shouldn't be out yet.


  Arthur Taber, reporter of the registered GSZ archive above, has also seen
  a file called GSZSER20.  This is apparently a "crack," which purports to
  register your copy of GSZ, if it is a release prior to September 1991.
  He is in the process of contacting Omen Technology about both files.

  To put a twist on yet another story, Joe Morlan (1:125/28) has reported
  the presence of an _upgrade_ to this file, called GSZSER22.  An upgraded
  "crack" is quite interesting, but also quite illegal to have.  Past
  programs of this type, aimed at DSZ (GSZ's "sister" program) have
  sometimes corrupted the copy of the DSZ file rather than "fixing" it.
  So, all things considered, it's cheaper to register than crack.


  Yet another one that doesn't seem to fit anywhere is a Windows program
  called WinSpeed.  Bill Eastman (1:382/87.12) relayed a message from Alan
  Zisman (1:153/9) in the WINDOWS echo about this file, and Piyadaroon
  Kalayanamit (1:382/87) quickly cleared the confusion.  Apparently, there
  are _two_ different programs called WinSpeed: one is a commercial package
  of Windows video drivers, which should not be posted for download on any
  BBS.  The other is a small utility that will report your system speed
  from within Windows, and is a legitimate shareware file.

  James Brown (1:266/22.0) has reported in the WINDOWS echo that the
  shareware WinSpeed has been renamed to WINDSOCK.  According to James,
  the author(s) took the original off of CompuServe, renamed it, and
  resubmitted it.  Hopefully, this will ease the confusion, but there
  _will_ be copies floating around under the old name.  So, be careful
  with this one.  If you get a copy of the video driver file from
  someone, delete it: it is not shareware.


  Finally, several people have been wondering whether a shareware version
  of XTreeGold has been released.  According to XTree Support (in the XTREE
  forum on CompuServe), the last shareware release of XTree was version
  2.00E (XTREE20E).  This is _not_ XTreeGold: in fact, no shareware release
  of XTreeGold has ever been made.  It is unclear as to whether a copy of
  XTreeGold has spread beyond the "pirate boards," but this much is clear:
  if you receive a version later than 2.00E that is described as shareware,
  delete it.  It's pirated.

  ========================================================================

                            Information, Please

  This the section of The Hack Report, where your Hack Squad asks for
  _your_ help.  Several reports come in every week, and there aren't enough
  hours in the day (or fingers for the keyboards) to verify them all.  Only
  with help from all of you can The Hack Report stay on top of all of the
  weirdness going on out there in BBSLand.  So, if you have any leads on
  any of the files shown below, please send it in: operators are standing
  by.


| A message in the FidoNet ASIAN_LINK echo from Choon Hwee (1:3603/263)
| grabbed my attention the moment I saw it: in capital letters, it said,
| "DO NOT RUN this file called MODTEXT.EXE, cause it is a TROJAN!!!".  He
| goes on to say that two BBSs have been destroyed by the file.  However,
| that's about all that was reported.  I really need more to go on before I
| can classify this as a Trojan and not just a false alarm (i.e., archive
| name, what it does, etc.).  Please advise.


| Greg Mills (1:16/390) posted a question to Robert Jung in the ARJ Support
| Echo (FidoNet) about a version of ARJ called 2.33.  It was unclear as to
| whether or not Mr.  Mills had seen the file.  Mr.  Jung has repeated that
| the latest version of ARJ is v2.30.  It is possible that the references
| Greg saw about 2.33 were typos, but you never know.  Please help your
| Hack Squad out on this one - if you see it, report it.


  I am still searching for information on a file called ALF.ZIP, reported
  originally by Cimarron Mittlesteadt in the WildNet Shareware Conference.
  His report stated that the file is a possible dropper of the Stoned
  virus.  However, no other information was given.

  Since his report, I have received further information from James Ellis
  (1:105/645.30) and Brian Caruso (1:320/201).  James says he tried to run
  it, and it locked his system, possibly due to a "CGA incompatibility."
  Brian's copy only had one file in it, called ALF.MOD.  Both reporters
| scanned their copies for viruses and found nothing.  Others have since
| reported seeing an ALF.MOD file, which is a non-executable music file.
| So, if anyone else has seen this or has any information on it, please
| forward it ASAP.  Otherwise, I think I'll have to drop this one as a
| false alarm.


  Harold Stein (WildNet) has found a version of CompuShow calling itself
  CSHOW91.*, with and archive date of April 18, 1992 (no internal file
  dates given).  I have not been able to check into this one, so I'd
  appreciate your assistance in verifying it.


  I still have no further confirmation of MTG2400, reported by Zach Adam of
  1:2200/103.  The description says this program will run a 2400bps modem
  like a 4800bps modem, which sounds a bit like the MTE program listed in
  the Pirated Commercial Software section.  Any information would be
  appreciated.

  ========================================================================

                               Clarification

| Eric Vaneberck (2:291/709) posted an inquiry in the FidoNet ZMODEM echo,
| asking about the latest release of the SuperZmodem protocol.  He has
| seen, as have I, a version called SZMOD200.  In order to verify this, I
| called up the bulletin board of the author, Scott Baker, and checked his
| file listings.  Fortunately, he had this file posted there.  So, this
| would appear to be a legitimate release.


| In the last issue of The Hack Update, I stated that I would remove a file
| called 4800BAUD.*, reported by Bjorn Engelhardt (3:634/393), from the
| pirated commercial software section.  However, another report of the same
| filename, this time a true pirated file, came in, so the file is back on.


| Finally, HackWatcher Ken Whiton forwards a comment from Quentin Stephens
| in the WildNet Shareware conference about a file reported in The Hack
| Report as a pirated file.  The file, called TUNNEL.ZIP, apparently shares
| the name of a game program written by Mr.  Stephens' brother.  His game
| is a 3D rollercoaster simulator and is not related to the file shown in
| The Hack Report.

  ========================================================================

                                  Credits

  Reference material used:

   Microsoft MS-DOS Programmer's Reference, Copyright 1991 Microsoft
   Corporation, Published by Microsoft Press.

  ************************************************************************

                                Conclusion

  If you see one of these on a board near you, it would be a very friendly
  gesture to let the SysOp know.  Remember, they can get in just as much
  trouble as the fiend who uploads pirated files, so help them out if you
  can.


                          ***HACK SQUAD POLICY***

  The intent of this report is to help SysOps and Users to identify
  fraudulent files.  To this extent, I give credit to the reporter of a
  confirmed hack.  On this same note, I do _not_ intend to "go after" any
  BBS SysOps who have these programs posted for d/l.  The Shareware World
  operates best when everyone works together, so it would be
  counter-productive to "rat" on anyone who has such a file on their board.
  Like I said, my intent is to help, not harm.  SysOps are strongly
  encouraged to read this report and remove all files listed within from
  their boards.  I can not and will not take any "enforcement action" on
  this, but you never know who else may be calling your board.  Pirated
  commercial software posted for d/l can get you into _deeply_ serious
  trouble with certain authorities.

  Updates of programs listed in this report need verification.  It is
  unfortunate that anyone who downloads a file must be paranoid about its
  legitimacy.  Call me a crusader, but I'd really like to see the day that
  this is no longer true.  Until then, if you _know_ of a new official
  version of a program listed here, please help me verify it.

  On the same token, hacks need to be verified, too.  I won't be held
  responsible for falsely accusing the real thing of being a fraud.  So,
  innocent until proven guilty, but unofficial until verified.

  Upcoming official releases will not be included or announced in this
  report.  It is this Co-Moderator's personal opinion that the hype
  surrounding a pending release leads to hacks and Trojans, which is
  exactly the opposite of what I'm trying to accomplish here.

  If you know of any other programs that are hacks, bogus, jokes, hoaxes,
  etc., please let me know.  Thanks for helping to keep shareware clean!

Lee Jackson, Co-Moderator, FidoNet International Echo SHAREWRE (1:382/87)
