  ========================================================================
                                    ||
  From the files of The Hack Squad: ||  by Lee Jackson, Co-Moderator,
                                    ||  FidoNet International Echo SHAREWRE
          The Hack Report           ||  Volume 1, Number 18
           for June 1992            ||  Report Date: June 5, 1992
                                    ||
  ========================================================================

  Welcome to the eighteenth issue of The Hack Report.  This is a series of
  reports that aim to help all users of files found on BBSs avoid
  fraudulent programs, and is presented as a free public service by the
  FidoNet International Shareware Echo and the author of the report, Lee
  Jackson (FidoNet 1:382/87.4).

| Last month was unusually active here at Hack Central Station: hacks,
| cracks, and Trojans abounded, and a commercial program caused a bit of
| discussion.  Thanks to everyone who has helped put this report together,
| and to those that have sent in comments and suggestions.


| HOW TO CONTACT THE HACK SQUAD:

| If you have a report or comment, I can be reached through any of the
| following systems and/or networks:

|     The ECS BBS at (512)328-6923  (leave message in the ECS_GENERAL area)
|     FidoNet:
|        FidoNet International Echo SHAREWRE
|        NetMail Address   1:382/87.4
|     RIME Address         MAH (Modem Addictus Hospital (512)443-8941)
|     CompuServe:
|        IBM BBS Forum (GO IBMBBS)
|        Mail Address   76040,2743
|     WildNet:
|        Leave messages in the Shareware Forum for Ken Whiton, who will
|        forward them to me.


  NOTE TO SYSOPS: The Hack Report may be freely posted as a bulletin on
  your BBS, subject to these conditions:

             1) the latest version is used,
             2) it is posted in its entirety, and
             3) it is not altered in any way.

  NOTE TO OTHER READERS: The Hack Report (file version) may be freely
  uploaded to any BBS, subject to the above conditions, and only if you do
  not change the filename.  You may convert the archive type as you wish,
  but please leave the filename in its original HACK????.* format.  The
  Hack Report may also be cross-posted in other networks (with the
  permission of the other network) as long as it meets the above conditions
  and you give appropriate credit to the FidoNet International Shareware
  Echo (and the author <g>).

  The idea is to make this information available freely.  However, please
  don't cut out the disclaimers and other information if you use it, or
  confuse the issue by spreading the file under different names.  Thanks!

  DISCLAIMER: The listings of Official Versions are not a guarantee of the
  files' safety or fitness for use.  Someone out there might just be
  sick-minded enough to upload a Trojan with an "official" file name, so

  >scan everything you download<!!!  The author of this report will not be

  responsible for any damage to any system caused by the programs listed as
  Official Versions, or by anything using the name of an Official Version.

  Now that the Draconian stuff is out of the way, let's get to the report!

  ************************************************************************

                              Hacked Programs

  Here are the latest versions of some programs known to have hacked copies
  floating around.  Archive names are listed when known, along with the
  person who reported the fraud (thanks from us all!).

   Program              Hack(s)            Latest Official Version
   -------              -------            -----------------------
|  Aliens Ate           !ALIENS                    K6DEMO
|   My Babysitter
|     Reported by:  Christopher Baker (1:374/14)

   AutoMenu             AUTO48                     AUTO47
      Reported by:  Tony Blair (WildNet)
                via Ken Whiton (1:132/152)
      Verified by Marshall Magee, Magee Enterprises, Inc.

|  CatDisk              CDISK510                   CDISK621
                        CDISK530
                        CDISK661
      Reported by:  Jeff Kaplow (1:120/234)

   CompuShow            CSHOW801                   CSHW844A
                        CSHOW831
                        CSHOW851
      Reported by:  Paul Brazil
      (Note:  Any version ending with a B, such as CSHW841B, is _not_
       a shareware version.  This is the enhanced version received
       with the user's registration and is not to be distributed.
       Consider all B archives to be pirated copies.)

   Las Vegas EGA Casino (unknown)
      Reported by the author, Diana Gruber, in the ILink net,
      relayed by Richard Steiner (1:282/85)
      (Note:  a version of this program sold through Gemini
       shareware outlets with the title screen "Special GEMINI
       game disk" and a version calling itself the "Ledyard$
       EGA Casino" have been distributed.  No archive names
       have been supplied yet.)

|  LHA Archiver         LHA214                     LHA213
|     Reported by: Patrick Lee (RIME address RUNNINGB)

   List                 LIST8                      LIST76B
                        LIST18
      Reported by: The Hack Squad (from the Buerg BBS)

   Math Master          MATHMSTR                   M-MST301
      Reported by: James Frazee (1:343/158)

   PKZip                PKZIP120                   PKZIP110
                        PKZIP20B
|                       PKZIP_V2.EXE
|     Reported by: Mike Burger (WildNet)
|              via Ken Whiton (1:132/152)
      Reported by: Fred Towner (1:134/73)
|                       PKZ201.ARJ
|     Reported by: Frank Pizer (5:71/0)
                        PKZ201.ZIP
                        PKZ201.EXE
      Reported by: Jim Westbrook (1:382/29)
                        PKX201.EXE
      Reported by: Bill Logan (1:300/22)
|                       PKUNZIP.COM
|     Reported by: Harold Stein, via Ken Whiton

   QEdit Advanced       XEDIT                      QEDIT215
      Reported by: Sammy Mitchell, Author
      (thanks to Rand Nowell and Joe Morlan for relaying the report)

   Telegard 2.9E Alpha  TG29EALP                   Telegard 2.7
      Reported by: Karen Maynor (1:3640/5)
      (Found on the NightOwl CD-ROM disc version 5.0)

   Telix                Telix v3.20                Telix v3.15
                        Telix v3.25
      Reported by: Brian C. Blad (1:114/107)
|                  Peter Kirn (WildNet, via Ken Whiton)
                        Telix v4.00
                        Telix v4.15
      Reported by: Barry Bryan (1:370/70)
                        Telix v4.25
|     Reported by: Daniel Zuck (2:247/30,
|              via Chris Lueders (2:241/5306.1)
                        MegaTelix
      Verified by Jeff Woods, Exis, Inc., in the TELIX echo,
      who also states that there will be _no_ release titled
      Telix 4.0.  He states the next release of Telix will be
      under a completely new name, which has not been decided
|     upon yet.  Any version with a number higher than 3.15
|     can be considered a confirmed hack, unless reported
|     here otherwise.

   TheDraw              TDRAW430                   TDRAW451
                        TDRAW500
      Reported by: Ian Davis, Author
                        TDRAW550
      Reported by: Steve Klemetti (1:228/19)
                        TDRAW600
      Reported by: Hawley Warren (1:120/297)
                        TDRAW800
      Reported by: James Carswell (1:153/775)

   Turbo Antivirus      Version 9.00b              Version 8.10
                        Version 9.01a
                        (Archive names unknown)
      Reported by: Thomas Ruess (2:246/24)

   X00 Fossil           X00V130                    X00V124
                        X00V130J                   (also official is
                                                    X00V149A, a beta
                                                    test of an OS/2 ver.)

| Finally, here's one I'm not sure how to handle: It's a hack, but it
| appears to be a hack of a commercial program.  Frank Pizer (5:71/0) has
| found a hack of a program called BitFax.  The hack, calling itself
| ZIPFAX.ZIP (at 146320 bytes), has been altered so that all occurrances of
| the word Bit with the word Zip.  The archive contains configuration files
| with the words "Technopoint - Avi Miller" in them.  Thanks to Frank for
| the report from Zone 5: let's hope the rest of us can keep it from
| spreading beyond there.

  =======================================================================

                                Hoax Alert:

| You guessed it: XTRATANK again, The Hoax That Would Not Die.  Kyle
| Pinkley (1:3803/1) forwarded a message from Dave Hanley of Lafayette, LA,
| that has reported some potentially damaging behavior by XTRATANK (seen as
| archive name XTANK).  Dave ran PC Tools' FIXDISK program with XTRATANK
| installed, and wound up trashing 20 megs of files before he could hit the
| reset button.  Kyle also tried the program himself, and had "Sector not
| found" errors after he deleted the program.

| Tony Summerfelt (1:249/99.2) reports that the following file is listed on
| the Nightowl 6 CD-ROM:

| XTRATANK.ZIP  47454  05-07-91  XtraTank v1.14 - it is designed to double
|                                the space available on a hard drive or
|                                drives.

| This is from the MASTER.LST file on the disk, according to Tony.

| For those of you who think that you may have XTRATANK actually working as
| advertised, here is the now-famous Fitzgerald Test, devised by Tim
  Fitzgerald of 1:3800/18.0.  Try this if you think you have managed to get
  XTRATANK to work on your system.  Follow these simple steps:

      1. Run CHKDSK and write down the free space it reports as free.
      2. Do a DIR command and write down what XTRATANK reports.
      3. Copy any text file to a new text file.
      4. Repeat steps 1 and 2, and compare.

  You will see that XTRATANK reports that twice as much disk space is taken
  up by the new text file.  Tim concludes that XTRATANK fools you into
  thinking that it gives you more space by doubling what the DOS DIR
| command reports.  If you get different results, _please_ send them to me
| immediately!  Until then, consider XTRATANK a hoax that doesn't work.

  Here's a twist: a file that looks like it might be a hoax, but isn't!
  Harold Stein (WildNet, via Ken Whiton) reported a file with the following
  description:

  PKCONTST.ZIP    14568  Win $1000 from PKWare if you can decrypt the ZIP
                         file contained herein.

  Suspicious looking, but according to Douglas Hay of PKWare (in the
  CompuServe PKWare Support Forum (PCVENC)), this is a legitimate release
  from the folks at PKWare.  At first, this looks odd: PKWare encouraging
  hacking?  However, after some discussion in FidoNet, I have to hand it to
  PKWare for the ingenuity of the idea.  (Maybe they'll be able to hire a
  top-flight programmer from the entries! <grin>)


  Other previously reported hoaxes:

  Filename       Claimed use/Actual activity/Reporter(s)
  ------------   --------------------------------------------------------
  2496.*         This, and all files that claim to run a 2400 bps
                 modem at 9600 or 14400 bps, are hoaxes.  If you
                 follow their instructions, you will have a 0 bps
                 modem.  Reported by several people.

  AMIGA.*        Claims to allow IBM/Clones to read Amiga Workbench
                 Disks: displays a picture of an Amiga Workbench disk
                 on your screen, then spins your A: drive and locks
                 your system.  From Suriya Matsuda, Jacob Kanafoski
|                (1:3613/4), Derek Vanmunster (1:229/418), and Jeff
                 Hancock (1:3600/7).

  BIMOD126.*     Claims to be version 1.26 of BiModem - actually v1.24
                 renamed and re-archived.

  =======================================================================

                              The Trojan Wars

| One of the most quickly identified and widely reported Trojans I've see
| came out this past month.  The victim this time was a "cheat" program for
| a wildly popular game.  However, that wasn't the only Trojan to pop up:
| read on for more details.


| Clayton Manson (1:3612/140) forwarded a message from R. Wallace Hale,
| SysOp of the Driftnet BBS (PC Virus Research Foundation), dated May 16,
| 1992 concerning a file called WLFCHEAT.*.  This claimed to be a program
| to help the user "cheat" on a game called Wolfenstein-3D.  The author of
| the file is stated as John M. Silverman, with no stated address.
| According to Mr.  Hale, the program wipes out your hard drive's boot
| sector and trashes the File Allocation Table.

| The archive contains the following files:

| Name         Length  Method   SF  Size now Mod Date    Time     CRC
| ============ ====== ======== ====  ======= =========  ======== ========
| WLFCHEAT.EXE  14784 Imploded  34      9751 05 May 92  11:00:20 909CC09E
| WLFCHEAT.TXT    548 Imploded  22       426 06 May 92  04:29:58 055E8C22
| ============ ====== ======== ====  ======= =========  ======== ========
| *total     2  15332 ZIP 1.10  32%    10399 10 May 92  21:49:54

| The .EXE file is apparently a TSR that eats 18160 bytes of RAM and hooks
| interrupt vectors 00, 05, 08, 09, 13h, 16h, 25h, 26h, and 28h.  After it
| is triggered, the damage is "virtually instantaneous."  The file passes
| all scanners (but see below), but Mr.  Hale says the string "WoLfIe" can
| be found at offset 3863h in the file.

| At this point, the story takes a strange twist.  Reports from Tr.  Curtis
| (1:387/255) and Karen Maynor state that there is a file called WLF1CHT.*
| that can be found as a freeware file on GEnie.  This file is not a Trojan
| or a dropper.  Kyle Pinkley (1:3803/2) says the author of this version is
| Michael P. Hoffman, who "makes a lot of cheats for Apogee" (the producers
| of Wolfenstein-3D), and confirms the non-Trojan status of WLF1CHT.  Jay
| Wilbur (1:124/6300) says that Mr.  Hoffman is aware of the Trojan, and,
| "would like to get the person who put in the trojan code in a room alone
| for just five minutes."

| David Byrnes (1:382/80) reports that McAfee's ViruScan, starting with
| release 90 (SCAN90.ZIP), will identify this as the [Wolf] virus.  So, if
| you get a copy of the cheat file, get a copy of the latest ViruScan,
| SCAN91, at the same time.  Just in case.


| A message from Bill Arlofski in the CNET Spitfire Support Conference
| (forwarded by several through Mark Wurtzler (1:294/9) to the FidoNet
| VIRUS_INFO echo) reports the existance of a dropper called CUBULOUS.ZIP.
| This file contains a new virus dubbed the REX virus.  This virus infects
| the boot sector, partition tables, and .com and .exe files as they are
| run.  Infected files will be 722 bytes longer after infection, according
| to Bill.

| McAfee's ViruScan v90 will not detect this virus, but v91 is supposed to.
| As usual, though, the best thing is to avoid this one altogether.


| A report has been relayed from Brian Hess (WildNet, via Ken Whiton)
| concerning a program called TMFIX.ZIP.  The archive contains the files
| TMFIX.EXE and TMFIX.DOC.  According to Brian, the file claims to fix a
| problem with Telemate's dialing function.  Instead, he said it formatted
| part of his hard drive.  Brian states he sent the file to McAfee
| Associates, who verified the Trojan nature of the program.  So, as usual,
| caveat downloader (let the downloader beware).


| James McKenzie (1:309/31) forwarded a report from the ACCESS Net Virus
| Forum concerning a file called TIME.ZIP.  The archive, size 4096 bytes,
| contains a file called TIME.EXE, size 4222 bytes.  James' report
| mentioned the following text located in the .EXE file, found by a utility
| called XRAY:

|     Have Fun!&
|     &Another Fine Virus By Ace Hacker
|     tO< r
|     tcQRW
|     #$456789:;<=>?uRuntime error  (This may be an XRAY message - Auth.)

| The file seems to be a bit schizophrenic, causing a hard drive crash on
| some systems and doing nothing to others.  Don't know what to make of
| this, but I wouldn't want it on my system. :-)


| Dan Christman (1:520/519) reported that there is a version of TheDraw
| that contains "several viruses." He says to watch for a file within the
| archive called THEDRAW.PCK.  This file, as far as my experience goes, is
| only created after the program is initially executed and is not part of
| the official archive.  Dan gave no filename for this dropper, but be on
| the lookout for an archive with the THEDRAW.PCK file in it.

| Just for the record (once again), the latest official release of TheDraw
| is v4.51.


| Another archiver has been hit:  apparently, this time it's ARJ.  Ken
| Miller (1:134/111) reports a file called ARJ240.EXE that was uploaded to
| the BBS operated by Hazel Clarke (1:134/68).  The file, which Hazel said
| "appears to have a secure envelope," was infected by the FISH virus.  Ken
| says this file was "wandering around Net 134" a while back.  For the
| record, the latest official release of the ARJ archiver is v2.30.

| COMMENTARY - This report was sent to Robert Jung in the FidoNet ARJ echo.
| He has not stated whether the next version will skip 2.40 and use a
| different number.  Hopefully, to avoid possible confusion with this
| dropper, he will decide to use a different number for his next release.


| Jay Siegel (1:153/151) reports that a user uploaded a file to his origin
| called QUICKEYS.ZIP, which contained the Burger virus.  No description
| was provided in this report, other than the following archive listing:

| Name         Length   Method    SF  Size now Mod Date   Time     CRC
| ============ ======== ======== ==== ======== ========= ======== ========
| QUICKEYS.COM      542 Imploded  27       392 01 Nov 90 03:34:32 E9C66BD8
| QUICKEYS.DOC      615 Imploded  20       491 01 Jan 80 03:36:28 6B5988A8
| ============ ======== ======== ==== ======== ========= ======== ========
| *total     2     1157 ZIP 1.10   5%     1119 17 May 92 21:27:58

| The QUICKEYS.COM file is actually the Burger virus and not a real
| program.

| Kent Anderson (1:382/87) has provided your Hack Squad with a copy of a
| file called QUICKEYS.COM (and an accompanying text file).  This is an
| older PC Magazine utility, designed to speed up PC/XT keyboards, and is a
| legitimate file.  The .com file is 273 bytes long, and was written by Leo
| Forest.  Further information will be provided next issue, but for now,
| watch out for bogus versions of QUICKEYS.


  Please be aware that the PKZip v2.0B hack reported in the hack
  section of this report could be a Trojan.  According to the report
  filed in the VIRUS_INFO echo by Fred Towner, the archive (an ARJ
  archive, no less(!)) had these files in it:

        PKZIP20B.EXE
        UNKNOWN.NFO
        MUSTREAD.COM (archived with PKLITE)
        WATCHME!.EXE (archived with PKLITE)

  Fred was wise enough not to try and run any of these programs, so
  Trojan activity has not been confirmed.
  
  
  Other previously reported Trojans/Droppers:

  Filename        Claimed use/Actual activity/Reporter(s)
  ------------    -------------------------------------------------------
  GREYSCAL.*      Claims to be a monitor adjustment utility - actually
                  a dropper - infects files on your hard drive with the
                  FISH virus through the README.EXE file in the archive.
                  Not detectable by any scanner.  From Bill Logan
                  (1:300/22).

  MONOP3-0.*      Supposed to be Monopoly for Windows.  Contains
                  FORMAT.COM from DOS 4.01 and STACKEY v2.1 (renamed as
                  MONOP1.COM and MONOPOLY.COM and invoked by a batch
                  file called README!!.BAT).  Will try and format your
                  hard drive - a volume label on your HD will thwart
                  this one.  From Derek Vanmunster (1:229/418).

  Obnoxious       "Tetris" clones for the Macintosh - actually droppers
    Tetris        of the MBDFA virus.  Via Paul Ferguson (1:109/229)
  Tetriscycle     in the VIRUS_INFO echo.
  Ten Tile Puzzle

  OCEAN.ZIP       From the BBS description: "Wonderful Game, Reward for
  PLANTS.ZIP      the person who conquers it 1 time, Good luck, how does
  RAINBOW.ZIP     30,000 bucks sound to you if you break the pattern, try
                  this game, it is wonderful, waht a challenge, bet you
                  can't break the pattern. $50, 000 if you do it twice."
                  Actually a compiled batch file that tries to erase all
                  files on your C: drive.  From Richard Dale (1:280/333).

  PSI3.ARJ        Passing itself as the LHA Archiver, version 3.00.  It
                  destroys your partition table, boot sector, and parts
                  of FAT 1 and FAT 2.  From Nemrod Kedem (2:403/138).

  SCAN87.*        Suspected of Trojan activity, but not confirmed.  The
| SCAN88.*        latest official release is SCAN91.  Reported by
  SCAN96.*        several.

  TGSEC16.*       Trojan version of Telegard Security Package - both
                  executables in the archive will infect your system
                  with the Dark Avenger virus, and the text files show
                  you how to ease access to your system by hackers instead
                  of prevent access.  By Scott Raymond, author of the
                  real package (latest official version is TGSEC17.*).

  VPIC47.*        One circulating version of this seems to contain the
                  Dark Avenger virus, "split" so that no scanner can pick
                  it up.  Get the latest version of VPic, VPIC48, to avoid
                  this.  From Tim Tim Sawchuck and Jeff Simmons in the
                  WildNet VIRUSES_MN conference.

  ZAPPER15.*      PSI3, mentioned above, recommends an "antivirus"
                  program called ZAPPER15.* to remove a virus called
                  "PSQR".  ZAPPER15 is another Trojan which overwrites
                  your hard disk's boot sector with random garbage data
                  from memory.  It contains no viral code.  Also from
                  Nemrod Kedem (2:403/138)

  ========================================================================

                        Pirated Commercial Software

  Program                 Archive Name(s)       Reported By
  -------                 ---------------       -----------
  Above Disk v3.00A       EXP-MEM.*             Dale Woloshin (1:163/211.3)
                                                and Wolfgang Fritz

  Backgammon Royale       BGROYALE.*            Shakib Otaqui (2:440/74)
                          BGROYDOX.*

  BeetleJuice (game)      BJUICE.*              Alan Hess (1:261/1000)
                          BJ.*                  Bill Blakely
                                                  (RIME Shareware echo)
|                         BTLJWC.*              the Hack Squad
|                                                 (1:382/87.4)

| Commander Keen          #2KEEN.*              Steve Hodsdon (1:132/199)
   (parts 2 and 3)        #3KEEN.*              Harold Stein
                                                 (via Ken Whiton, 1:132/152)

  Double Disk             DDISK214.*            Ronald McGill (1:167/149)

  Duke Nukem parts 2 & 3  DUKEZIP2.EXE          Steve Hodsdon (1:132/199),
                          #2DUKE.*              Craig Demarsh (1:260/213),
                          DUKEZIP3.EXE          and Hal Thompson (1:353/220)
|                         DUKETRIL.*            Harold Stein (WildNet)
|                          (all 3 Duke Nukems-
|                           #2 & #3 are pirates)

  Eagle's Nest (game)     EAGLE.*               Mike Headley (1:362/112)
                                                Frank R Pizer (5:71/0)

  Fastback Plus v2.0      FBPL200.*             Bogie Bugsalewicz (1:115/738)

  Flashlink MNP Emulator  FLASHLNK.*            Several

  Gauntlet (game)         GAUNTLET.*            Cimarron Mittlesteadt
                                                 (via Ken Whiton, WildNet)

| GSZ                     GSZ0410.*             Arthur Taber (1:125/28)
|  NOTE: GSZ is a shareware program,             (via Stuart Kremsky)
|  but this particular archive was
|  the registered version.

  LotusWorks v1.0         LWORKS.*              Brian Luker (1:167/149)

  Mac-in-Dos              CLINK.*               Arthur Taber (1:125/28)
                     (not the SEALink protocol)
                          MAC-DOS.*             Ron Bass (1:128/13.3)
                                                Leslie Meehan, original
                                                  reporter (unknown)
|                         MACON-5.*             Kimberly Avery (1:324/278)

  Microsoft Mouse Driver  MOUSE810.*            Bat Lang (1:382/87)

  MTE MNP Emulator        MTE215.*              Bat Lang (1:382/87)
                          MTE210E.*
                          MTE210F.*
                          MTE210G.*
                          MX5.*                 Wolfgang Fritz
                                    Verified by Steve Lieberman
                                             of MagicSoft, Inc.
                          MX6.*

  Optune                  OPTUNE.*              Bat Lang (1:382/87)
                          OPTUNE11.*
                          OPTUNE12.*            Jeff Dunlop (1:203/16)

  Paganitzu part 2        #2PAGA.*              Harold Stein
                                                 (via Ken Whiton, 1:132/152)

  QModem 5.0              QM50.*                Daniel Hagerty (1:208/216)
                          QMODEM50.*            Larry Owens (1:280/87)

  Rambo (game)            RAMBO.*               Cimarron Mittlesteadt
                                                 (via Ken Whiton, WildNet)

  SimCGA                  SIMCGA40.*            Joe Morlan (1:125/28)
                          SIMCGA41.*
|  NOTE: SimCGA went commercial with release 4.0, according to the
|  publisher (via Joe Morlan).  Versions prior to this were copyrighted
|  free programs.

  SIMCITY                 SIMCITY.*             Mark Visser

  Solitare Royale         SOLITRYL.*            Dan Brady (1:282/108)
                          SOLIT.*               Bud Webster (1:264/165.7)

| Spot (7-Up game)        SPOT.*                Steve Hodsdon (1:132/199)

  Squish 2.1              SQUISH21.*            Several
                                                (verified by Joe Morlan)

  Supaplex                Unknown               Kevin Donald (1:123/54)
                                                Rick Rosinski (1:239/1004)
                                                Dennis Matney (1:230/12)

| Tetris (the original)   #1TETRIS              Harold Stein (WildNet)

  Top Gun                 TOPGUN.*              Cimarron Mittelsteadt
                                                 (WildNet, via Ken Whiton)

  Tunnels of Armageddon   TUNNELS1.*            Wolfgang Fritz (1:249/140)
                          TUNNELS2.*

  ========================================================================

                      ?????Questionable Programs?????

| Steve Klemetti (1:228/19) has found an archive of the Apogee game
| Paganitzu (#1PAGA.ZIP) that may either be a hack or a corrupted archive.
| The file size is 281K, and the .EXE file within is 8K (vs 11K for the
| official archive.  Steve says the opening screens go by "too fast," then
| the program puts your hard drive in "a constant seek mode." The file
| passed viral scanning.  Like I said, this could just be a corrupt
| archive, but you never know.  Just be on the lookout for an archive that
| meets these specs, and avoid it.  The real thing is a pretty decent game,
| though, according to my 5-year old son, so don't avoid _all_ #1PAGA.*
| files just because of a bad version.

| While we're on the subject of Apogee games, there seems to be a constant
| state of confusion regarding the numbering system they use to identify
| shareware releases.  At this time, your Hack Squad is attempting to
| contact an Apogee representative via the RIME network.  Hopefully, he
| will be able to shed some light on the subject for all of us.  Watch this
| space.


  BiModem is the subject this time, but the situation doesn't quite fit
  into any of the other categories of this report.  A few users have seen a
  version called BIMOD125.* floating around, and wondered if it was a hack.
  Steve Baker (1:114/116.0) called the support BBS and verified your Hack
  Squad's information: v1.25 is a closed beta.  Version 1.24 is the latest
  public release.  This information was also verified by the Hack Squad (in
  lurk mode over in the BIMODEM echo) through a message posted by Michael
  Ingram (1:114/151).  In short, if you see BIMOD125, delete it - it's a
  beta that shouldn't be out yet.


| Arthur Taber, reporter of the registered GSZ archive above, has also seen
| a file called GSZSER20.  This is apparently a "crack," which purports to
| register your copy of GSZ, if it is a release prior to September 1991.
| He is in the process of contacting Omen Technology about both files.

| To put a twist on yet another story, Joe Morlan (1:125/28) has reported
| the presence of an _upgrade_ to this file, called GSZSER22.  An upgraded
| "crack" is quite interesting, but also quite illegal to have.  Past
| programs of this type, aimed at DSZ (GSZ's "sister" program) have
| sometimes corrupted the copy of the DSZ file rather than "fixing" it.
| So, all things considered, it's cheaper to register than crack.


  Yet another one that doesn't seem to fit anywhere is a Windows program
  called WinSpeed.  Bill Eastman (1:382/87.12) relayed a message from Alan
  Zisman (1:153/9) in the WINDOWS echo about this file, and Piyadaroon
  Kalayanamit (1:382/87) quickly cleared the confusion.  Apparently, there
  are _two_ different programs called WinSpeed: one is a commercial package
  of Windows video drivers, which should not be posted for download on any
  BBS.  The other is a small utility that will report your system speed
  from within Windows, and is a legitimate shareware file.

  James Brown (1:266/22.0) has reported in the WINDOWS echo that the
  shareware WinSpeed has been renamed to WINDSOCK.  According to James,
  the author(s) took the original off of CompuServe, renamed it, and
  resubmitted it.  Hopefully, this will ease the confusion, but there
  _will_ be copies floating around under the old name.  So, be careful
  with this one.  If you get a copy of the video driver file from
  someone, delete it: it is not shareware.


| Finally, several people have been wondering whether a shareware version
| of XTreeGold has been released.  According to XTree Support (in the XTREE
| forum on CompuServe), the last shareware release of XTree was version
| 2.00E (XTREE20E).  This is _not_ XTreeGold: in fact, no shareware release
| of XTreeGold has ever been made.  It is unclear as to whether a copy of
| XTreeGold has spread beyond the "pirate boards," but this much is clear:
| if you receive a version later than 2.00E that is described as shareware,
| delete it.  It's pirated.

  ========================================================================

                            Information, Please

| This is a new section of The Hack Report, where your Hack Squad asks for
| _your_ help.  Several reports come in every week, and there aren't enough
| hours in the day (or fingers for the keyboards) to verify them all.  Only
| with help from all of you can The Hack Report stay on top of all of the
| wierdness going on out there in BBSLand.  So, if you have any leads on
| any of the files shown below, please send it in: operators are standing
| by.


  Cimarron Mittlesteadt reports in the WildNet Shareware Conference that a
  file called ALF.ZIP is a possible dropper of the Stoned virus.  However,
  no other information was given.  If anyone has seen this or has any
  information on it, please forward it ASAP.


| Harold Stein (WildNet) has found a version of CompuShow calling itself
| CSHOW91.*, with and archive date of April 18, 1992 (no internal file
| dates given).  I have not been able to check into this one, so I'd
| appreciate your assistance in verifying it.


  I still have no further confirmation of MTG2400, reported by Zach Adam of
  1:2200/103.  The description says this program will run a 2400bps modem
  like a 4800bps modem, which sounds a bit like the MTE program listed in
  the Pirated Commercial Software section.  Any information would be
  appreciated.

  ========================================================================

                               Clarification

| Last month's issue reported a program called Bootcon (by Modular Software
| Systems) that had been seen by Mike Dunsmore in the RIME Shareware echo.
| I must admit that I jumped the gun on this: Mike had obtained a demo copy
| of the program, and was not reporting a pirated file.  Further
| investigation has not turned up any pirated versions of Bootcon.

| I would like to apologize to Mike Dunsmore for this error, and to all
| readers of this report.  I try to verify everything I report on, and I
| thought I had verified this.  I did verify that Bootcon is indeed
| commercial, but no pirate version exists yet.  Better safe than sorry,
| but still, I extend my apologize.

  ************************************************************************

                                Conclusion

  If you see one of these on a board near you, it would be a very friendly
  gesture to let the SysOp know.  Remember, they can get in just as much
  trouble as the fiend who uploads pirated files, so help them out if you
  can.
      
                          ***HACK SQUAD POLICY***

  The intent of this report is to help SysOps and Users to identify
  fraudulent files.  To this extent, I give credit to the reporter of a
  confirmed hack.  On this same note, I do _not_ intend to "go after" any
  BBS SysOps who have these programs posted for d/l.  The Shareware World
  operates best when everyone works together, so it would be
  counter-productive to "rat" on anyone who has such a file on their board.
  Like I said, my intent is to help, not harm.  SysOps are strongly
  encouraged to read this report and remove all files listed within from
  their boards.  I can not and will not take any "enforcement action" on
  this, but you never know who else may be calling your board.  Pirated
  commercial software posted for d/l can get you into _deeply_ serious
  trouble with certain authorities.

  Updates of programs listed in this report need verification.  It is
  unfortunate that anyone who downloads a file must be paranoid about its
  legitimacy.  Call me a crusader, but I'd really like to see the day that
  this is no longer true.  Until then, if you _know_ of a new official
  version of a program listed here, please help me verify it.

  On the same token, hacks need to be verified, too.  I won't be held
  responsible for falsely accusing the real thing of being a fraud.  So,
  innocent until proven guilty, but unofficial until verified.

  Upcoming official releases will not be included or announced in this
  report.  It is this Co-Moderator's personal opinion that the hype
  surrounding a pending release leads to hacks and Trojans, which is
  exactly the opposite of what I'm trying to accomplish here.

  If you know of any other programs that are hacks, bogus, jokes, hoaxes,
  etc., please let me know.  Thanks for helping to keep shareware clean!

Lee Jackson, Co-Moderator, FidoNet International Echo SHAREWRE
