From gamma!ulysses!allegra!princeton!udel!rochester!rutgers!mit-eddie!w8sdz Wed Dec 31 19:00:00 1969
Relay-Version: version B 2.10.1 6/24/83; site lcuxa.UUCP
Path: gamma!ulysses!allegra!princeton!udel!rochester!rutgers!mit-eddie!w8sdz
From: w8sdz@mit-eddie.UUCP
Newsgroups: comp.binaries.ibm.pc
Subject: FLUSHOT3.ARC protect against Trojans program
Message-ID: <8220@eddie.MIT.EDU>
Date: Sun, 21-Feb-88 19:32:37 EST
Article-I.D.: eddie.8220
Posted: Sun Feb 21 19:32:37 1988
Date-Received: 
Reply-To: w8sdz@eddie.MIT.EDU (Keith Petersen)
Followup-To: comp.sys.ibm.pc
Organization: MIT, EE/CS Computer Facilities, Cambridge, MA
Lines: 276
Keywords: protect,torjan,virus,flushot

Below is a uuencoded copy of FLUSHOT3.ARC.  This is an update to
FLUSHOT2, announced previously, a program to protect your COMMAND.COM,
FAT, boot sector, NOVRAM, etc., against Trojan horses.

The following is a list of its contents.  If you get this file from
other sources be sure to check the CRCs to make sure they match this
listing. (more comments on this below).

Name          Length    Stowage    SF   Size now  Date       Time    CRC
============  ========  ========  ====  ========  =========  ======  ====
DISCLAIM.TXT       640  Crunched   27%       469  10 Feb 88   0:00a  4B65
FLUSHOT2.INF      2176  Crunched   38%      1361  10 Feb 88   0:00a  C709
FLUSHOT3.COM      2363  Crunched   20%      1912  10 Feb 88   0:00a  6C75
FLUSHOT3.INF      2432  Crunched   34%      1627  10 Feb 88   0:00a  2DA1
FLU_SHOT.DOC      4045  Crunched   43%      2322  10 Feb 88   0:00a  4C6A
REGISTER.TXT      2816  Crunched   57%      1220  10 Feb 88   0:00a  15D8
        ====  ========            ====  ========
Total      6     14472             39%      8911  

--from file FLUWARN2.TXT--

                FURTHER INFORMATION ON "FLUSHOT" FILES!

The program FLU-SHOT.arc has had "some" copies "BUGGED". Instead of
protecting you from the so called "COMMAND VIRUS"...they actually
erase Command interpreters and files!

I spoke to the author today. A new version of Flushot has been
released called FLUSHOT3.ARC. USE ONLY THIS VERSION ! Other versions
"M A Y" have been tampered with and be Trojan. To get a working copy
of the "GOOD" FLUSHOT PROGRAM call 212-889-6438 and download
FLUSHOT3.ARC.

If you have a copy of any other release...please check it out                

                          C A R E F U L L Y !

FLUSHOT3 is and excellent program....and has been installed on my
Board with no problems. I was NOT so lucky with the original version I
received. It had been tampered with and....erased over 15 files and
Command.com interpreters from my system and the systems of 5 other
users. Some had to completely re-format!

There "may" be other so-called "cures" that ( in actuality ) are
Trojan. ALWAYS test these programs before installation and BE SURE
they are OK!

WARNING: ON tampered versions of FLU-SHOT, most Bomb programs detect
no problems with the program...I know because I ran three of them
before installing to my system. After my disaster...I looked at the
program using various utility files. I can still detect nothing out of
the ordinary. However, looking at command.com (after the installation)
you will note "garbage" at the end of your current command.com file.
If you see this "DO NOT RE-BOOT YOUR SYSTEM! TAKE YOUR ORIGINAL DOS
BOOT DISK and COPY COMMAND.COM OVER THE OLD VERSION ON YOUR HARD-DISK!
I did not do this and....... you know the rest.

                           Leonard Lee..Sysop
                             VoiceQuest RBBS
                             (601) 638-3390

---end included text--

Good advice.  The file FLUSHOT3.ARC on SIMTEL20 came direct from Ross
Greenberg, the author of FLUSHOT.  I downloaded it myself from his BBS.

--Keith Petersen
Arpa: W8SDZ@SIMTEL20.ARPA
Uucp: {decwrl,harvard,lll-crg,ucbvax,uunet,uw-beaver}!simtel20.arpa!w8sdz