  ========================================================================
                                    ||
  From the files of The Hack Squad: ||  by Lee Jackson, Co-Moderator,
                                    ||  FidoNet International Echo SHAREWRE
          The Hack Report           ||  Volume 1, Number 20
          for August 1992           ||  Report Date: August 1, 1992
                                    ||
  ========================================================================

  Welcome to the twentieth issue of The Hack Report.  This is a series of
  reports that aim to help all users of files found on BBSs avoid
  fraudulent programs, and is presented as a free public service by the
  FidoNet International Shareware Echo and the author of the report, Lee
  Jackson (FidoNet 1:382/95).

  Over the past few weeks, there have been reports of a hoax involving a 
  popular game, numerous Trojans, and several new pirated files. Thanks to 
  everyone who has helped put this report together, and to those that have 
  sent in comments and suggestions.


  HOW TO CONTACT THE HACK SQUAD:

  If you have a report or comment, I can be reached through any of the
  following systems and/or networks:

|     The ECS BBS at (512)328-6923  (leave message in the HACK area)
      FidoNet:
|        FidoNet Backbone Echos: SHAREWRE, PDREVIEW, DIRTY_DOZEN
|        NetMail Address   1:382/95 (Private Node - Hub Route all NetMail)
      RIME Address
|        Route messages to MAH (Modem Addictus Hospital (512)443-8941)
|        in the Shareware conference
      CompuServe:
         IBM BBS Forum (GO IBMBBS)
         Mail Address   76040,2743
      Internet:
         Lee Jackson on "The Middle of Nowhere", Kyle, TX  1:382/95@fidonet
         ljackson@mdf.fidonet.org
         Hack Report notices to hackreport@mdf.fidonet.org

  THE HACKWATCHERS:

  If you are unable to contact me directly, you should try and contact one
  of The HackWatchers.  This is a small group of people who cover other
  parts of the world with their eyes wide open for hacks and other frauds.
  They may be reached as follows:

     HackWatcher           Network/Conference/Other Info
     ===============       =============================
     Frank R Pizer         FidoNet Zone 5 (South Africa)
                           FidoNet NetMail Address 5:7102/713
 
     Richard Steiner       RIME (RelayNet) Shareware Conference
                           FidoNet NetMail Address 1:282/85
 
     Ken Whiton            WildNet! Shareware Conference
                           FidoNet NetMail Address 1:132/152

| Selections for new members of The HackWatchers have been made, but I have 
| not heard back from all of them yet.  Watch the FidoNet Shareware echo 
| for an announcement of the newest HackWatchers.


  NOTE TO SYSOPS: The Hack Report may be freely posted as a bulletin on
  your BBS, subject to these conditions:

             1) the latest version is used,
             2) it is posted in its entirety, and
             3) it is not altered in any way.

  NOTE TO OTHER READERS: The Hack Report (file version) may be freely
  uploaded to any BBS, subject to the above conditions, and only if you do
  not change the filename.  You may convert the archive type as you wish,
  but please leave the filename in its original HACK????.* format.  The
  Hack Report may also be cross-posted in other networks (with the
  permission of the other network) as long as it meets the above conditions
  and you give appropriate credit to the FidoNet International Shareware
  Echo (and the author <g>).

  The idea is to make this information available freely.  However, please
  don't cut out the disclaimers and other information if you use it, or
  confuse the issue by spreading the file under different names.  Thanks!

  DISCLAIMER: The listings of Official Versions are not a guarantee of the
  files' safety or fitness for use.  Someone out there might just be
  sick-minded enough to upload a Trojan with an "official" file name, so
  >scan everything you download<!!!  The author of this report will not be
  responsible for any damage to any system caused by the programs listed as
  Official Versions, or by anything using the name of an Official Version.

  ************************************************************************

                            ==== EDITORIAL ====
 
| Since the last issue, there has been a bit of discussion about whether 
| programs that claim to "crack" commercial and shareware programs should 
| be reported here.  Some said that they should be reported, while others 
| said that it would not be wise to "advertise" the existence of such 
| files.  Still others recommended a separate report (The Crack Report?) to 
| be distributed only to SysOps.
| 
| Your Hack Squad put its head together and has decided not to report on 
| these files at all.  There is a logical reason for this:  these files, 
| when uploaded to a BBS, are not anonymous.  They advertise their 
| presence, along with exactly what they are meant to do, in the file 
| description.  If you have one on your BBS, it isn't hard to locate it.
| 
| I do not intend to debate the legality of "unprotects" or other programs 
| that register shareware for you without your paying for it.  I'm not even 
| sure what my own feelings are on these files.  However, I do feel that 
| they are beyond the scope of this report, which is to inform the public 
| of potentially dangerous files and pirated commercial files (cracked or 
| otherwise) that may sneak into unsuspecting BBS systems.
| 
| The best advice I can give to SysOps is to regularly check their file 
| lists.  Look for files whose descriptions say something about "cracking" 
| or "unprotecting" other software.  Then, let your own sense of ethics 
| guide you in your decision.

  Whew!  The first, and hopefully the last, full-blown editorial to appear 
  in The Hack Report, is finished.  Now that the Draconian stuff is out of 
  the way, let's get to the report!

  ************************************************************************

                              Hacked Programs

  Here are the latest versions of some programs known to have hacked copies
  floating around.  Archive names are listed when known, along with the
  person who reported the fraud (thanks from us all!).

   Program              Hack(s)            Latest Official Version
   -------              -------            -----------------------
   Aliens Ate           !ALIENS                    K6DEMO
    My Babysitter
      Reported by:  Christopher Baker (1:374/14)

   AutoMenu             AUTO48                     AUTO47
      Reported by:  Tony Blair (WildNet)
                via Ken Whiton (1:132/152)
      Verified by Marshall Magee, Magee Enterprises, Inc.

|  CatDisk              CDISK510                   CDISK631
                        CDISK530
                        CDISK661
      Reported by:  Jeff Kaplow (1:120/234)

   CompuShow            CSHOW801                   CSHW844A
                        CSHOW831
                        CSHOW851
      Reported by:  Paul Brazil
      (Note:  Any version ending with a B, such as CSHW841B, is _not_
       a shareware version.  This is the enhanced version received
       with the user's registration and is not to be distributed. 
       Consider all B archives to be pirated copies.)

|  HS/Link              HSLK113                    HSLK112
|     Reported by:  Samuel H. Smith, the Author
|                   of HS/Link (in the HACK message
|                   area on The ECS BBS)
  
   Las Vegas EGA Casino (unknown)
      Reported by the author, Diana Gruber, in the ILink net,
      relayed by Richard Steiner (1:282/85)
      (Note:  a version of this program sold through Gemini
       shareware outlets with the title screen "Special GEMINI
       game disk" and a version calling itself the "Ledyard$
       EGA Casino" have been distributed.  No archive names
       have been supplied yet.)

   LHA Archiver         LHA214                     LHA213
      Reported by: Patrick Lee (RIME address RUNNINGB)

   List                 LIST8                      LIST76B
                        LIST18
      Reported by: The Hack Squad (from the Buerg BBS)

   Math Master          MATHMSTR                   M-MST301
      Reported by: James Frazee (1:343/158)

   PKZip                PKZIP120                   PKZIP110
                        PKZIP20B
                        PKZIP_V2.EXE
      Reported by: Mike Burger (WildNet)
               via Ken Whiton (1:132/152)
      Reported by: Fred Towner (1:134/73)
                        PKZ201.ARJ
      Reported by: Frank Pizer (5:71/0)
                        PKZ201.ZIP
                        PKZ201.EXE
      Reported by: Jim Westbrook (1:382/29)
                        PKX201.EXE
      Reported by: Bill Logan (1:300/22)
                        PKZ210F.EXE
      Reported by: Bert Bredewoud (2:281/703)
                        PKZIPV2
      (Claims to be v2.2 of PKZip - reported via PKWare Tech Support)
                        PKUNZIP.COM
      Reported by: Harold Stein, via Ken Whiton
|                       PKZIP203.EXE
|     Reported by: Mark Clark (2:440/107)


   QEdit Advanced       XEDIT                      QEDIT215
      Reported by: Sammy Mitchell, Author
      (thanks to Rand Nowell and Joe Morlan for relaying the report)
                        QEDIT500  
      Reported by: Onno Tesink (ILink, via Richard Steiner, 1:282/85)

|  Qmodem               QM451                      QM452TD
|     Reported by: Bill Lambdin, via Arthur Shipkowski (1:260/213.2)

|  Shez                 SHEZ72A                    SHEZ74
|                       SHEZ73
|     Reported By: Bill Lambdin (1:343/45)
  
   Telegard             TG29EALP                   Telegard 2.7
      Reported by: Karen Maynor (1:3640/5)
      (Found on the NightOwl CD-ROM disc version 5.0)
|                       JIGSAWV2
|     Reported by: Tommy Smith, via Mark Evans (1:382/87)

   Telix                Telix v3.20                Telix v3.15
                        Telix v3.25
      Reported by: Brian C. Blad (1:114/107)
                   Peter Kirn (WildNet, via Ken Whiton)
                        Telix v4.00
                        Telix v4.15
      Reported by: Barry Bryan (1:370/70)
                        Telix v4.25
      Reported by: Daniel Zuck (2:247/30,
               via Chris Lueders (2:241/5306.1)
                        MegaTelix
      Verified by Jeff Woods, Exis, Inc., in the TELIX echo,
      who also states that there will be _no_ release titled
      Telix 4.0.  He states the next release of Telix will be
      under a completely new name, which has not been decided
      upon yet.  Any version with a number higher than 3.15
      can be considered a confirmed hack, unless reported
      here otherwise.
|                       Telix Pro
|     Reported by: Jason Engebretson (address unknown),
                   in the FidoNet TELIX echo
  
   TheDraw              TDRAW430                   TDRAW451
                        TDRAW500
      Reported by: Ian Davis, Author
                        TDRAW550
      Reported by: Steve Klemetti (1:228/19)
                        TDRAW600
      Reported by: Hawley Warren (1:120/297)
|                       THEDR60
|     Reported by: Larry Owens (PDREVIEW echo, 1:280/17)
                        TDRAW800
      Reported by: James Carswell (1:153/775)

   Turbo Antivirus      Version 9.00b              Version 8.10
                        Version 9.01a
                        (Archive names unknown)
      Reported by: Thomas Ruess (2:246/24)
 
   ViruScan             SCAN92                     SCAN93
      Reported by: Don Dunlop (1:153/715)

   X00 Fossil           X00V130                    X00V124
                        X00V130J                   (also official is
                                                    X00V149A, a beta
                                                    test of an OS/2 ver.)

  *** More Hacks

| Bill Dennison (1:273/216) saw a copy of the PKZ201.EXE file mentioned 
| above, but with a twist:  when he used the file view feature of the BBS 
| he saw it on, he saw that the file was not a PKZip SFX (self-extracting) 
| file, but was an LHA SFX (using -lh5- compression).  This, folks, is a 
| bit of a giveaway.  PKWare isn't likely to use any archiver other than 
| ZIP to distribute their next release.
  
  
  Chris Lueders (2:241/5306.1) reports that a file calling itself VPIC50DT
  is a hack of version 4.5 of the VPic graphics file viewer.  Specifically,
  the 5.0dt file ("dt" indicates a German language edition, per Chris) is a
  hack of the English version 4.5.  At the time of the report, version 4.9
  was the latest official release, but now a legitimate version 5.0 is out.
  Be careful, then: if your copy of VPIC50 starts up in German, delete it.


| Zone 2 (especially UK) users might want to watch out for a disk being 
| distributed by Personal Computer World magazine.  Shakib Otaqui (2:
| 440/74) reports that all of the files on the August issue's "free" cover 
| disk are zipped using the PKZip 1.93 alpha test release, and that the 
| version of PKZip distributed with the disk is the hacked version 2.01.  
| The PKZip 2.01 file is 19793 bytes, dated March 15, 1992, and is PKLited 
| with the extra compression (non-expandable) option.


  Finally, here's one I'm not sure how to handle: It's a hack, but it 
| appears to be a hack of a commercial program.  HackWatcher Frank Pizer 
  has found a hack of a program called BitFax.  The hack, calling itself 
  ZIPFAX.ZIP (at 146320 bytes), has been altered so that all occurrences of 
  the word Bit with the word Zip.  The archive contains configuration files 
  with the words "Technopoint - Avi Miller" in them.  Thanks to Frank for 
  the report from Zone 5: let's hope the rest of us can keep it from 
  spreading beyond there.

  =======================================================================

                                Hoax Alert:

| Jay Wilbur (1:124/6300) of Id Software, the creators of Wolfenstein-3D, 
| reports a hoax update file to Wolf-3D that claims to patch your file to 
| version 1.3.  It also goes on to talk about alpha and beta versions of 
| "the Daylight Missions."  None of these are real - there is no version 
| 1.3, nor are any "Daylight Missions" planned.
| 
| The file (WOLFXXX.*, reported to Jay by Joe Siegler from Apogee Site #77) 
| had only files with the extension .WAL, along with an ad for a BBS and a 
| file called WOLF.TXT.  The WOLF.TXT file takes the hoax to a further 
| level - it tells the reader that future episodes of Wolf-3D can be 
| received directly from Apogee Software for $25 per episode.  However, the 
| address listed is not for Apogee - it doesn't even appear to be a valid 
| address at all.
| 
| For the record, here is the correct address for Apogee Software:
| 
|                          Apogee Software, Inc.
|                              PO Box 476389
|                           Garland, TX  75047
 
  
| HackWatcher Richard Steiner forwards some information from Mike Bray 
| (RIME address COFFEE, in the Shareware conference) about a previously 
| reported problem with HIMEM500.  As reported here originally from Joe 
| Morlan (1:125/28), this is a "hex editor" job, where someone has taken 
| Microsoft's HIMEM.SYS version 3.07 and changed a few bytes to make it 
| print out v5.00 instead of v3.07 at startup.  Mike specifically states 
| that there are only 4 bytes different between the two files, all in a 
| text area, and all having to do with the version number and file date 
| (reported at startup as 05/14/92 - should be 02/14/92).  Finally, he 
| notes that this is not a Trojan or a virus:  just a hoax file (and a 
| pirated one - Ed.).
  

| Kim Miller (1:103/700) forwarded a message to the SHAREWRE echo from an 
| unidentified user about a file called SPEEDUP.COM.  The message stated 
| that this is a "harmless" hoax that doubles the length of each second of 
| your computer's clock and resets it to use 30 of these new seconds per 
| minute.  I'm not sure what this means, but keep your eyes open anyway.

  
| An update on the testing of XTRATANK - I have sent a copy of the file to 
| Bill Logan, an agent of McAfee Associates, for testing.  He is putting 
| the program through the wringer right now, so we should soon have an 
| expert opinion on the status of this file.  Stay tuned!

  Just so that those of you in North America won't feel alone, HackWatcher
  Frank Pizer forwarded a report from Johan Erlank (5:7101/6.1) that
  XTRATANK has been seen in a South African shareware distribution store
  and in an article in a South African computer magazine.  Bad news travels
  fast, I guess. :-)

  Also, HackWatcher Ken Whiton forwarded an interesting opinion from Jon
  Jasiunas in the WildNet!  Shareware Conference.  Jon said that what he
  had read about XTRATANK indicates that the author never really intended
  for it to do what it claims.  He guesses that someone other than the
  author released the file with the claim of doubling your hard drive
  space.  If true, that would explain a lot.

| Thanks to Brian Durham (1:3612/210) for reporting a file called XT_HOAX 
| which "debunks" the entire XTRATANK hoax.
  
| Also, thanks to Steve Baker (1:114/116) for his warning that you must 
| "uninstall" XTRATANK rather than just delete its files (if you have been 
| caught by this hoax).  A friend installed it, tested it, and confirmed the 
| hoax on a Tandy 1000, then found that deleting the files made the hard 
| drive inaccessible.
  
  *** The Fitzgerald Test

  Until we hear from Mr. Logan, here is the now-famous Fitzgerald Test,
  devised by Tim Fitzgerald of 1:3800/18.0.  Try this if you think you have
  managed to get XTRATANK to work on your system.  Follow these simple
  steps:

      1. Run CHKDSK and write down the free space it reports as free.
      2. Do a DIR command and write down what XTRATANK reports.
      3. Copy any text file to a new text file.
      4. Repeat steps 1 and 2, and compare.

  You will see that XTRATANK reports that twice as much disk space is taken
  up by the new text file.  Tim concludes that XTRATANK fools you into
  thinking that it gives you more space by doubling what the DOS DIR
  command reports.  If you get different results, _please_ send them to me
  immediately!  Until then, consider XTRATANK a hoax that doesn't work.


  Other previously reported hoaxes:

  Filename       Claimed use/Actual activity/Reporter(s)
  ------------   --------------------------------------------------------
  2496           This, and all files that claim to run a 2400 bps
                 modem at 9600 or 14400 bps, are hoaxes.  If you
                 follow their instructions, you will have a 0 bps
                 modem.  Reported by several people.

  AMIGA          Claims to allow IBM/Clones to read Amiga Workbench
                 Disks: displays a picture of an Amiga Workbench disk
                 on your screen, then spins your A: drive and locks
                 your system.  From Suriya Matsuda, Jacob Kanafoski
                 (1:3613/4), Derek Vanmunster (1:229/418), and Jeff
                 Hancock (1:3600/7).

  BIMOD126       Claims to be version 1.26 of BiModem - actually v1.24
                 renamed and re-archived.

  MAXRES         Claims to "check your graphics interface and show you
                 resolutions of your interface card."  Elaborate hoax
                 that lists the author as Samuel H. Smith (of HS/Link
                 fame).  Mr. Smith has confirmed that he did not write
                 this program.  Possible Trojan, but no Trojan activity
                 has been reported.
  
  =======================================================================

                              The Trojan Wars

  Whoever is responsible for writing all of the Trojans seen last month 
  must have been putting in some heavy-duty overtime.  A virtual flood of 
  reports poured in to Hack Central Station.  So, grab your snorkels, put 
  on your swim fins, and let's dive into this mess.  Read on.


| Tim Spofford (1:105/99) forwarded a message by Ron Westlake (1:105/18) 
| about a recent "commando raid" on his board.  An unidentified person 
| using a fake FidoNet node number sent the file CSHOW900.ZIP as a 
| file-attach message to Ron's system.  The files in this archive are:
| 
| Name         Original Method     Packed CR%   Date     Time   CRC
| FONTS   .DRV     5632 Implode      2567  46  3-12-92 12:00:00 FE417541
| VIDEOA2 .DRV      566 Implode       475  84  3-12-92 12:00:00 8A159F34
| CSHOW900.EXE     3120 Implode      2180  70  7-18-92  3:24:54 7FA1DDC6
| VIDEOA4 .DRV      393 Implode       352  90  3-12-92 12:00:00 A3C5C32A
| VIDEOA5 .DRV      845 Implode       749  89  3-12-92 12:00:00 7196EB81
| VIDEOA6 .DRV      467 Implode       380  81  3-12-92 12:00:00 469E0368
| ORDRFORM.DOC     1863 Implode       816  44  3-12-92 12:00:00 CD6A7C7B
| VIDEOC1 .DRV      554 Implode       506  91  3-12-92 12:00:00 3D3A6FB1
| VIDEOC2 .DRV      356 Implode       295  83  3-12-92 12:00:00 B4914F3A
| VIDEOD1 .DRV     1220 Implode       526  43  3-12-92 12:00:00 8C6A8935
| VIDEOE1 .DRV      761 Implode       673  88  3-12-92 12:00:00 E0D7FB47
| VIDEOG1 .DRV      628 Implode       568  90  3-12-92 12:00:00 AB0BF88E
| VIDEOH1 .DRV     1475 Implode       962  65  3-12-92 12:00:00 7F14B1EC
| VIDEOI1 .DRV      497 Implode       361  73  3-12-92 12:00:00 574FC927
| CSHOW900.DAT       21 Shrunk         20  95  7-18-92  1:00:58 C0DF9384
|       15        18398 ZIP         11430  62  7-18-92  3:24:54
|
| Ron looked at the .EXE file with Vern Buerg's LIST.COM and found these 
| strings:
| 
|   command.com c:\command.com c:\dos\command.com c:\dos40\command.com
|   c:\dos41\command.com c:\dos50\command.com
| 
| He ran the file from a ramdisk, where it tried to truncate the 
| COMMAND.COM file on the disk.  Since there wasn't one, it created a zero 
| byte COMMAND.COM file.  With all of the above strings, it is possible 
| that this Trojan aims at more than the root directory when it does its 
| dirty work.

  
| While we're on the subject of TheDraw, Arthur Shipkowski (1:260/213.2) 
| forwards a report from Glen Appleton (1:260/371) about a file called 
| FONTS.*, that claims to be additional fonts for TheDraw.  This archive 
| contains two files:  FONTS.DOC and FONTS.COM.  Glen said the .com file 
| looks like a compiled batch file that changes to your C: drive's root 
| directory and deletes all files therein.  Glen ran the file and 
| experienced the results firsthand.  Your Hack Squad has seen other files 
| with the same archive name that were perfectly legitimate, so don't DEL 
| FONTS.* without giving it a good looking-at first.
  

| Paul Drapeau (1:322/594) reported in the FidoNet VIRUS_INFO echo a new 
| virus called Power Pump.  Normally, viruses by themselves are not 
| reported in The Hack Report/Update, but this is an unusual situation.  
| According to Paul's research, all droppers of this virus have a file in 
| their archives called POWER.EXE, with instructions to the user not to run 
| this file.  He does not understand the connection, but the virus will not 
| run without the POWER.EXE file.
| 
| A few specifics on Power Pump:  it doesn't actually attach its code to 
| files, but uses the "corresponding file" technique.  It looks for .EXE 
| extension files, then creates a file with the same root name but with 
| a .COM extension.  Since DOS executes .COM files before .EXE files, the 
| viral file (1199 bytes long) is run first, where it executes the viral 
| code and passes execution on to the corresponding .EXE file.  The virus 
| also looks for empty directories:  if it finds one, it creates a hidden 
| file called COM (with no file extension) that contains the viral code.
| 
| To date, Paul says the virus has been found in two archives (one of 
| SCAN89.ZIP and one of VSUMX204.ZIP).  These may have been localized 
| occurrences, but be on the lookout for any file with a POWER.EXE file in 
| the archive.
  

| Robert Hinshaw (1:291/16) and Eric Kimminau (1:120/335) both forwarded a 
| message by Eric Pullen (USTGNET) about a couple of Trojans.  First, Eric 
| reports a Trojan called TG27FAST that claims to "speed up" Telegard.  The 
| .ZIP file (5097 bytes) actually is a disk-eater: when ran from a floppy, 
| the floppy was damaged enough to be unrecoverable.  When he ran it from an 
| old hard drive, the HD required reformatting.  Dangerous.
  
| Eric also found a Trojan called 240TOMNP that at first glance looked like 
| another MTE pirate.  However, this file (.ZIP 5295 bytes) trashed another 
| floppy (apparently the same way as TG27FAST - Eric didn't elaborate).

  
| Herb Oxley (1:101/435) forwarded a message to the COMM echo from Tom Ward, 
| Sysop of the BCS TI99 BBS (617-331-4181) about an ASCII text file bomb 
| (actually appears to be an ANSI bomb) called FREEHST.ZIP.  This file is 
| supposed to tell you how to get a free HST modem (its advice: steal one).  
| It also does several keyboard remapping tricks, including a fake C> prompt 
| and a few FORMAT invocations.  The DOS Type command is somehow intercepted 
| and translated into a FORMAT command as well.  The best way to avoid ANSI 
| bombs is to use an ANSI driver that can disable keyboard redefinitions, 
| such as NANSI or PKSFANSI.

  
| Mark Evans (1:382/87) forwarded a message from Michael Masters, SysOp of 
| the Conceptual CAD Design BBS in Tempe, AZ, about a file called MOBYZ.*.  
| The message stated that this file will "do a number on your hard drive."  
| Michael said he uploaded the file to the McAfee BBS, who confirmed its 
| Trojan nature.  No further details were given, but this seems like enough 
| to warrant avoiding the file.

  
| David Ekins (2:254/78) reports in the VIRUS echo that he just spent 2 days 
| recovering from an attack on his BBS by a file called BILLNTED.EXE.  This 
| bogus journey begins with a message that says, "Decompressing database, 
| please wait......" It then says, "Looks like Evil Spirits's Bill'N'Ted has 
| formatted your drive,dude."  This file trashed David's partition table and 
| formatted the first 50 tracks of his hard drive.  David goes on to say it 
| does not appear to affect non-boot drives.

  
| Rick Rosinski (1:239/1004) reports in the FidoNet PDREVIEW echo that a 
| file called #1BLAST passed through his area recently.  He said it 
| appeared to be a "re-hash" of Moraff's Super Blast, but the archive 
| contained some hidden system files that would copy over your own system  
| files if you're not careful.  He also says this archive "dumps a bunch of 
| files into one's root directory."  I don't know if this is an intentional 
| Trojan file, or just a messy rearchiving job.  The best way to protect 
| yourself here would be to use a utility such as FV.COM or RView to 
| examine the archive before opening it.  Then, you can selectively unpack 
| what you want.
  
  
| I have further information from Patrick Pfadenhauer (via Mark Evans,
| 1:382/87) about a file called EPW27.*.  The real EPW protects .EXE and
| .COM files with passwords and encrypts the password file.  The dropper, 
| v2.7, contains three virii:  ITTI-A, ITTI-B, and Rock Steady, loaded by a 
| batch file that installs "drivers" and runs the program.
  
  
| HackWatcher Ken Whiton forwarded a message from Jim Lambert (WildNet 
| Shareware Conference) about a file called SHIELD20.*, which claims to 
| protect you from Trojans.  Instead, Jim says the file is a Trojan itself.  
| He did not elaborate.
  
| Ken also forwarded another message from Gary Meade, SysOp of the Tiger Run 
| BBS in Sioux Falls, SD, about a file called VGA835.* which claims to be a 
| VGA game.  In fact, it wipes out your hard drive.

  
| Dan Stark (1:247/101) found a file called VIRTUAL.ARJ, claiming to be a 
| virtual reality game.  One of the files in the archive has the text 
| string, "This bombing was   compliments of A.C.K. and its affiliates."  He 
| says he sent this to McAfee, who say it will trash your hard drive.
  
| Dan also reports a file called BACKFIND.EXE that has several obscene text 
| strings in it.  He didn't know what it would do, but from the strings, it 
| seems that it will do serious damage to your system's drives.
  
| Another report from Dan concerns a CVIR.EXE (2336 bytes), a claimed virus 
| scanner.  This one also has some obscenity in the .EXE:  an abridged 
| version shows, "/Checking drive for VIRII/TROJANs.  Please wait.EHAHA  God 
| your a ****ing moron.  YOU HAVE BEEN HIT BY A TROJAN!  HAHA".  Looks 
| nasty.
  
| Finally, Dan reports on WHALE.COM, claimed to be a VGA graphic of a whale.  
| Virus watchers would suspect this immediately, and correctly - it is the 
| straight WHALE virus code.  Thanks to Dan for these reports:  I hope none 
| of them hit his system.
  
    
| An update on the COMPILER.ARJ file reported in the last full issue of The 
| Hack Report:  Dave Doehrman (1:236/21) reported in the PDREVIEW echo that 
| he uploaded a copy to the McAfee BBS for testing.  A reply from Spencer 
| Clark on this BBS stated that when the file was run, it erased the 
| COMMAND.COM file in the current directory.  So, our suspicions were 
| correct:  this is a Trojan.
|  
| For those of you that missed it, this file claims to be a freeware 
| version of Stacker.  It has a quite convincing text file in it that lists 
| a 1-800 number for technical support and another phone number for 
| questions.  Your Hack Squad, always curious, called the 1-800 number 
| listed in the text file and very quickly discovered it was a "phone sex" 
| number and not a customer support line.  Bruce Diamond (1:130/47) called 
| the other phone number and found it to be disconnected.
|
| This looks like a very deceptive attempt to trash your system.  I'd avoid 
| it at all costs.


  A file was sent to Hack Central Station by Michael Kerr (1:309/7), called
  NPV2.ZIP.  This file contains something called the "Non-Programmer's
  Virus." According to Michael, the file is unusual in that the virus
  source code is contained in the file.

  To compound matters, the file contains an infected version of LIST.COM
  which is not caught by McAfee's SCAN.  Michael, like many of us, fires up
  LIST right after unarchiving a file to read the docs, so the infected
  version executed before the one on his path, and boom!  His system was
  infected.

  Michael says that the program is supposedly an aid in testing anti-viral
  software.  With this in mind, a copy of this file has been sent to Bill
  Logan (1:300/22) for testing.  Results of his tests will be reported here
  as soon as they arrive.


  Dan Christman (1:520/519) reported that there is a version of TheDraw
  that contains "several viruses." He says to watch for a file within the
  archive called THEDRAW.PCK.  This file, as far as my experience goes, is
  only created after the program is initially executed and is not part of
  the official archive.  Dan gave no filename for this dropper, but be on
  the lookout for an archive with the THEDRAW.PCK file in it.

  Just for the record (once again), the latest official release of TheDraw
  is v4.51.


  Please be aware that the PKZip v2.0B hack reported in the hack
  section of this report could be a Trojan.  According to the report
  filed in the VIRUS_INFO echo by Fred Towner, the archive (an ARJ
  archive, no less(!)) had these files in it:

        PKZIP20B.EXE
        UNKNOWN.NFO
        MUSTREAD.COM (archived with PKLITE)
        WATCHME!.EXE (archived with PKLITE)

  Fred was wise enough not to try and run any of these programs, so
  Trojan activity has not been confirmed.


  Other previously reported Trojans/Droppers:

  Filename        Claimed use/Actual activity/Reporter(s)
  ------------    -------------------------------------------------------
  ARJ240.EXE      Supposed "latest version" of the popular Archiver by
                  Robert Jung (ARJ).  This is a dropper of the FISH virus,
                  reportedly with a "secure envelope." Latest official
                  version of ARJ is 2.30.  Reported by Hazel Clarke
                  (1:134/68) via Ken Miller (1:134/111).

  CUBULOUS        No claim reported for this file - apparently contains
                  a dropper of the REX virus (detected by SCAN v91 and
                  higher).  Reported by Bill Arlofski in the CNET Spitfire
                  Support Conference, forward by several through Mark
                  Wurlitzer (1:294/9).

  GREYSCAL        Claims to be a monitor adjustment utility - actually
                  a dropper - infects files on your hard drive with the
                  FISH virus through the README.EXE file in the archive.
                  Not detectable by any scanner.  From Bill Logan
                  (1:300/22).

  MONOP3-0        Supposed to be Monopoly for Windows.  Contains
                  FORMAT.COM from DOS 4.01 and STACKEY v2.1 (renamed as
                  MONOP1.COM and MONOPOLY.COM and invoked by a batch
                  file called README!!.BAT).  Will try and format your
                  hard drive - a volume label on your HD will thwart
                  this one.  From Derek Vanmunster (1:229/418).

  Obnoxious       "Tetris" clones for the Macintosh - actually droppers
    Tetris        of the MBDFA virus.  Via Paul Ferguson (1:109/229)
  Tetriscycle     in the VIRUS_INFO echo.
  Ten Tile Puzzle

  OCEAN.ZIP       From the BBS description: "Wonderful Game, Reward for
  PLANTS.ZIP      the person who conquers it 1 time, Good luck, how does
  RAINBOW.ZIP     30,000 bucks sound to you if you break the pattern, try
                  this game, it is wonderful, waht a challenge, bet you
                  can't break the pattern. $50, 000 if you do it twice."
                  Actually a compiled batch file that tries to erase all
                  files on your C: drive.  From Richard Dale (1:280/333).

  PSI3.ARJ        Passing itself as the LHA Archiver, version 3.00.  It
                  destroys your partition table, boot sector, and parts
                  of FAT 1 and FAT 2.  From Nemrod Kedem (2:403/138).

  QUICKEYS        Claims to increase keyboard speed - turns out to be the
                  actual executable file of the BURGER virus.  The virus
                  file is called QUICKEYS.COM and is 542 bytes long.
                  This is not to be confused with the PC Magazine Utility
                  of the same name.  Reported by Jay Siegel (1:153/151).

  RAMBO           Contains files with the names of DOS devices that are
                  affected when the archive is viewed or unpacked.
                  Reported by Michael Toth (1:115/439.7).

  SCAN87          Suspected of Trojan activity, but not confirmed.  The
  SCAN88          latest official release is SCAN93.  Reported by
  SCAN96          several.

  TGSEC16         Trojan version of Telegard Security Package - both
                  executables in the archive will infect your system
                  with the Dark Avenger virus, and the text files show
                  you how to ease access to your system by hackers instead
                  of prevent access.  By Scott Raymond, author of the
                  real package (latest official version is TGSEC17.*).

  TIME            Several files reported under this name - one dropper,
                  one Trojan.  Be wary of any file with this name.

  TMFIX           Claims to fix a problem with the dialing directory used
                  by the communication program Telemate.  Formats your hard
                  drive (or at least part of it) instead.  Reported by
                  Brian Hess (WildNet), via HackWatcher Ken Whiton.

  VPIC47          One circulating version of this seems to contain the
                  Dark Avenger virus, "split" so that no scanner can pick
                  it up.  Get the latest version of VPic, VPIC50, to avoid
                  this.  From Tim Tim Sawchuck and Jeff Simmons in the
                  WildNet VIRUSES_MN conference.

  WLFCHEAT        Claims to be a "cheat" file for the Apogee/Id game
                  Wolfenstein-3D.  Actually wipes out your hard drive's
                  boot sector and trashes the File Allocation Tables.
                  Not to be confused with WLF1CHT, a legitimate "cheat"
                  file written by Michael P. Hoffman.  Reported by
                  R. Wallace Hale, SysOp of the Driftnet BBS
                  (PC Virus Research Foundation), via Clayton Manson
                  (1:3612/140).

  ZAPPER15        PSI3, mentioned above, recommends an "antivirus"
                  program called ZAPPER15.* to remove a virus called
                  "PSQR".  ZAPPER15 is another Trojan which overwrites
                  your hard disk's boot sector with random garbage data
                  from memory.  It contains no viral code.  Also from
                  Nemrod Kedem (2:403/138)

  ========================================================================

                        Pirated Commercial Software

  Program                 Archive Name(s)       Reported By
  -------                 ---------------       -----------
| 4X4 off-road racing     4X4                   Jon Jasiunas (WildNet, via
|  (Epyx)                                        HackWatcher Ken Whiton)
  
  Above Disk v3.00A       EXP-MEM               Dale Woloshin (1:163/211.3)
                                                and Wolfgang Fritz

| Alf and the Alley Cats  ALF                   Bill Dennison (1:273/216)
    
| Amiga ARexx Manual      AREXXMAN              HTom Trites (1:282/62),
|  (Verified by William Hawes, author)           via Derek Oldfather
  
  Backgammon Royale       BGROYALE              Shakib Otaqui (2:440/74)
                          BGROYDOX  

| Bargames                BARGAMES              Scott Lewis (1:107/607)
|  (game from Accolade)

  BeetleJuice (game)      BJUICE                Alan Hess (1:261/1000)
                          BJ                    Bill Blakely
                                                  (RIME Shareware echo)
                          BTLJWC                the Hack Squad
                                                  (1:382/95)

  BitFax 1.22B            Unknown               Antonio Rezende (RIME)

| Blockout                BLOCKOUT              Bill Lambdin (1:343/45)
|  (California Dreams)
  
  Commander Keen          #2KEEN                Steve Hodsdon (1:132/199)
   (parts 2 and 3)        #3KEEN                Harold Stein
                                                 (via Ken Whiton, 1:132/152)

  Double Disk             DDISK214              Ronald McGill (1:167/149)

  Duke Nukem parts 2 & 3  DUKEZIP2.EXE          Steve Hodsdon (1:132/199),
                          #2DUKE                Craig Demarsh (1:260/213),
                          DUKEZIP3.EXE          and Hal Thompson (1:353/220)
                          DUKETRIL              Harold Stein (WildNet)
   (also under various other names - only the first game in the trilogy
    is shareware:  #2 & #3 are for registered users only and are pirated.)

| Dune (game)             DUNEFLT1              Michael Toth (1:115/439.7)
|                         DUNEFLT2
|                         DUNEFLT3

  Eagle's Nest (game)     EAGLE                 Mike Headley (1:362/112)
                                                Frank R Pizer (5:71/0)

| EMM386                  EMM386                Jeff Hancock (1:3600/7)
|                                               George Staikos
|                                                 via Mark Evans (1:382/87)
  
  Fastback Plus v2.0      FBPL200               Bogie Bugsalewicz (1:115/738)

  Flashlink MNP Emulator  FLASHLNK              Several

  Gauntlet (game)         GAUNTLET              Cimarron Mittlesteadt
                                                 (via Ken Whiton, WildNet)

| GIFLite v1.40           GIFLT14R              Stephen Kawamoto
|  (Registered Version)                          (1:153/7004)

  GSZ                     GSZ0410               Arthur Taber (1:125/28)
                                                 (via Stuart Kremsky)
                          GSZ1214R              Harold Stein,
   NOTE: GSZ is a shareware program,             via Ken Whiton (1:132/152)
   but these particular archives were
   the registered versions.

| IronMan off-road racing IRONMAN               Jon Jasiunas (WildNet, via
|                                                HackWatcher Ken Whiton)
  
  KDREAMS                 KDREAMS               John Van Eekelen (2:500/228)
   (game from Softdisk)

  LotusWorks v1.0         LWORKS                Brian Luker (1:167/149)

  Mac-in-Dos              CLINK                 Arthur Taber (1:125/28)
                     (not the SEALink protocol)
                          MAC-DOS               Ron Bass (1:128/13.3)
                                                Leslie Meehan, original
                                                  reporter (unknown)
                          MACON-5               Kimberly Avery (1:324/278)

  Microsoft Mouse Driver  MOUSE810              Bat Lang (1:382/87)

  MTE MNP Emulator        4800BAUD              George Staikos,Trenton,ON,
                                                 via Mark Evans (1:382/87)
                          MTE215                Bat Lang (1:382/87)
                          MTE210E  
                          MTE210F  
                          MTE210G  
                          MX5                   Wolfgang Fritz
                                    Verified by Steve Lieberman
                                             of MagicSoft, Inc.
                          MX6  

  MTEZ (MagicSoft)        MTZ115B1              Kim Miller (1:103/700)

  Optune                  OPTUNE                Bat Lang (1:382/87)
                          OPTUNE11  
                          OPTUNE12              Jeff Dunlop (1:203/16)
|                         OPTUNE13              Michael Toth (1:115/439.7)  
  
  Paganitzu part 2        #2PAGA                Harold Stein
                                                 (via Ken Whiton, 1:132/152)

  QModem 5.0              QM50                  Daniel Hagerty (1:208/216)
                          QMODEM50              Larry Owens (1:280/87)
|                         QMODEM1               Jon Jasiunas (WildNet, via
|                         QMODEM2                HackWatcher Ken Whiton)
|                         QMODEM3
|                         QMODEM4  
  
  Rambo (game)            RAMBO                 Cimarron Mittlesteadt
                                                 (via Ken Whiton, WildNet)

  Red Baron game          unknown               Nolan Taylor (1:157/537)
    (by Dynamix)

  SimCGA                  SIMCGA40              Joe Morlan (1:125/28)
                          SIMCGA41  
   NOTE: SimCGA went commercial with release 4.0, according to the
   publisher (via Joe Morlan).  Versions prior to this were copyrighted
   free programs.

  SimCity (by Maxis)      SIMCITY               Mark Visser
|                         SHRCTY-1              Richard Steiner,
|                         SHRCTY-2               HackWatcher
  
  Solitare Royale         SOLITRYL              Dan Brady (1:282/108)
                          SOLIT                 Bud Webster (1:264/165.7)

| Sourcer disassembler    SOURCER               Bill Lambdin (1:343/45)
  
  Spidey (game)           SPIDEY                Brian Henry (ILink,
                                                 via Richard Steiner,
                                                  HackWatcher
    
  Spot (7-Up game)        SPOT                  Steve Hodsdon (1:132/199)

  Squish 2.1              SQUISH21              Several
                                                (verified by Joe Morlan)

| Squish Plus 2.01        SQUISH21              Stephen Kawamoto
|  (Sundog Software)                             (1:153/7004)
  
  Supaplex                Unknown               Kevin Donald (1:123/54)
                                                Rick Rosinski (1:239/1004)
                                                Dennis Matney (1:230/12)

  SuperStor               SSTOR204              John Van Eekelen (2:500/228)

| System Control          PCSSCC                Ken Whiton, HackWatcher
|  Commander (from
|  PC Sources Mag)
  
  Tetris (the original)   #1TETRIS              Harold Stein (WildNet)

  Tidbits                 TIDBITS               Art Taber
   (game? from Softdisk)                         via Stuart Kremsky
                                                  (1:125/28)

| Toobin' (game)          TOOBIN                Joseph Lowe (1:387/1201)
  
  Top Gun                 TOPGUN                Cimarron Mittelsteadt
                                                 (WildNet, via Ken Whiton)

  Tunnels of Armageddon   TUNNELS1              Wolfgang Fritz (1:249/140)
                          TUNNELS2  

| UTscan                  UTSCAN                Bill Lambdin (1:343/45)
|  (part of the Untouchable package by Fifth Generation Systems)
  
  VGA-Copy v4.6           VGACPY46              Bert Bredewoud (2:281/703)
   (Registered Copy)

  Wolfenstein-3D          WOLFSINC              Jeff Kaplow (1:120/364)
   (Non-Shareware modules)
  
  ========================================================================

                      ?????Questionable Programs?????

| To clear things up on a recurring question, HackWatcher Richard Steiner 
| (1:282/85) did some further research on the status of a so-called 
| shareware version of SimCity.  According to a Maxis representative on 
| America OnLine, "SimCity *is* not shareware, *has* not been shareware, 
| and *will* not be shareware."  Enough said.

  
| Also on the game front, some official information about which Apogee 
| releases are shareware.  According to Jay Wilbur (1:124/6300) of Id 
| Software, episodes 1 and 4 of Commander Keen, along with the demo version 
| of episode 6 are distributable, as is episode 1 of Wolfenstein 3-D.  Other 
| versions of these games are not supposed to be posted for download.

  
| Rajeev Seth (1:250/328) reports in the FidoNet PDREVIEW echo on TGCHAT21, 
| a program claiming to use the Soundblaster or AdLib card as the bell for 
| paging the SysOp in Telegard.  He says he tried to run this from a floppy 
| disk and wound up trashing the floppy and his hard drive (drive D:).  
| This might be due to the fact that it was run from the floppy, but it 
| doesn't seem likely that a file like this could be that disk specific 
| without being dangerous.  As usual, if someone has further info, please 
| forward it.
  

  Jan Welch (1:382/87) has reported in the FidoNet VIRUS echo a file called
  W3DEDIT.ZIP, which she claims is a Trojan that will attack your hard
  drive's boot sector.  At first glance, this looks like a renamed
  WLFCHEAT, but I can't be sure.  I've sent NetMail for more information,
  so be on the lookout and report anything you know about it, if you would.


  Steve Klemetti (1:228/19) has found an archive of the Apogee game
  Paganitzu (#1PAGA.ZIP) that may either be a hack or a corrupted archive.
  The file size is 281K, and the .EXE file within is 8K (vs 11K for the
  official archive.  Steve says the opening screens go by "too fast," then
  the program puts your hard drive in "a constant seek mode." The file
  passed viral scanning.  Like I said, this could just be a corrupt
  archive, but you never know.  Just be on the lookout for an archive that
  meets these specs, and avoid it.  The real thing is a pretty decent game,
  though, according to my 5-year old son, so don't avoid _all_ #1PAGA.*
  files just because of a bad version.


  BiModem is the subject this time, but the situation doesn't quite fit
  into any of the other categories of this report.  A few users have seen a
  version called BIMOD125.* floating around, and wondered if it was a hack.
  Steve Baker (1:114/116.0) called the support BBS and verified your Hack
  Squad's information: v1.25 is a closed beta.  Version 1.24 is the latest
  public release.  This information was also verified by the Hack Squad (in
  lurk mode over in the BIMODEM echo) through a message posted by Michael
  Ingram (1:114/151).  In short, if you see BIMOD125, delete it - it's a
  beta that shouldn't be out yet.


  Yet another one that doesn't seem to fit anywhere is a Windows program
  called WinSpeed.  Bill Eastman (1:382/87.12) relayed a message from Alan
  Zisman (1:153/9) in the WINDOWS echo about this file, and Piyadaroon
  Kalayanamit (1:382/87) quickly cleared the confusion.  Apparently, there
  are _two_ different programs called WinSpeed: one is a commercial package
  of Windows video drivers, which should not be posted for download on any
  BBS.  The other is a small utility that will report your system speed
  from within Windows, and is a legitimate shareware file.

  James Brown (1:266/22.0) has reported in the WINDOWS echo that the
  shareware WinSpeed has been renamed to WINDSOCK.  According to James,
  the author(s) took the original off of CompuServe, renamed it, and
  resubmitted it.  Hopefully, this will ease the confusion, but there
  _will_ be copies floating around under the old name.  So, be careful
  with this one.  If you get a copy of the video driver file from
  someone, delete it: it is not shareware.


  Finally, several people have been wondering whether a shareware version
  of XTreeGold has been released.  According to XTree Support (in the XTREE
  forum on CompuServe), the last shareware release of XTree was version
  2.00E (XTREE20E).  This is _not_ XTreeGold: in fact, no shareware release
  of XTreeGold has ever been made.  It is unclear as to whether a copy of
  XTreeGold has spread beyond the "pirate boards," but this much is clear:
  if you receive a version later than 2.00E that is described as shareware,
  delete it.  It's pirated.

  ========================================================================

                            Information, Please

  This the section of The Hack Report, where your Hack Squad asks for
  _your_ help.  Several reports come in every week, and there aren't enough
  hours in the day (or fingers for the keyboards) to verify them all.  Only
  with help from all of you can The Hack Report stay on top of all of the
  weirdness going on out there in BBSLand.  So, if you have any leads on
  any of the files shown below, please send it in: operators are standing
  by.


| Kim Miller (1:103/700) found a file called HOMELAWY.*, which is titled 
| "Home Legal Form Helper."  The program is copyrighted by OverDrive 
| Systems, Inc. in 1989, and is shown as Licensed to MECA Ventures, Inc.  
| Several people in the FidoNet SHAREWRE echo have reported this as a 
| possible pirated file.  I am not familiar with either company mentioned 
| above, but Kyle Pinkley (1:3803/3.2) reports that they are the producers 
| of the commercial package Managing Your Money.  I haven't been able to 
| completely verify any of this, so please forward any info you may have.
  

| George Staikos (via Mark Evans, 1:382/87) reports a file called ADDMEM21 
| that is supposed to create additional low DOS memory by using your VGA 
| memory.  All it did was blank out his SVGA monitor.  If anyone else has 
| info on this file, please forward it.
  
  
| Bud Webster (1:264/165.7) reports an Apogee game being distributed under 
| the filename BLOCK5.ZIP.  He says that the game displayed a message that 
| said, "This game is not in the public domain or shareware."  There was 
| only an .EXE file in the archive, and no documentation.  I need to know 
| what the real name of this game is so that I can include it in the pirated 
| files section (if necessary).
  

| Now, a sensitive subject.  Arthur Shipkowski (1:260/213.2) forwarded a 
| message from Kenny Root (GT-Net Shareware Forum), about a file called 
| SHAMpage (SHMPG310.*).  Kenny claims he downloaded this from a Door 
| Distribution Network board, unzipped and ran it, and wound up with 
| thousands of directories and the 1260 virus.  This is the only report I 
| have of this, and it is unconfirmed.
| 
| I posted a question about this in a local echo in Austin, and found no 
| one who had experienced the same symptoms.  I also consulted George 
| Vandervort (1:382/8), a beta tester for SHAMpage, and learned that the 
| file that went out over the Door Distribution Network was perfectly 
| legitimate and not harmful in any way.
| 
| George speculates, and I agree, that if this situation is true, then it 
| was possibly caused by someone infecting it in transit by adding a Zip 
| comment.  George also says that if any copy does not have a "DrawBridge 
| Zip Comment and Auto CRC check when unzipped," it was probably tampered 
| with by some other system.  For the record, the latest version according 
| to George is SHAMpage v3.14.
| 
| In summary, SHAMpage 3.10 is a legitimate file, but a tampered archive of 
| it may be floating around.  If anyone sees an altered archive of this 
| file, please forward the information so that I can post specifics on it.
  
      
  A message in the FidoNet ASIAN_LINK echo from Choon Hwee (1:3603/263)
  grabbed my attention the moment I saw it: in capital letters, it said,
  "DO NOT RUN this file called MODTEXT.EXE, cause it is a TROJAN!!!".  He
  goes on to say that two BBSs have been destroyed by the file.  However,
  that's about all that was reported.  I really need more to go on before I
  can classify this as a Trojan and not just a false alarm (i.e., archive
  name, what it does, etc.).  Please advise.


  Greg Mills (1:16/390) posted a question to Robert Jung in the ARJ Support
  Echo (FidoNet) about a version of ARJ called 2.33.  It was unclear as to
  whether or not Mr.  Mills had seen the file.  Mr.  Jung has repeated that
  the latest version of ARJ is v2.30.  It is possible that the references
  Greg saw about 2.33 were typos, but you never know.  Please help your
  Hack Squad out on this one - if you see it, report it.


  Harold Stein (WildNet) has found a version of CompuShow calling itself
  CSHOW91.*, with and archive date of April 18, 1992 (no internal file
  dates given).  I have not been able to check into this one, so I'd
  appreciate your assistance in verifying it.


  I still have no further confirmation of MTG2400, reported by Zach Adam of
  1:2200/103.  The description says this program will run a 2400bps modem
  like a 4800bps modem, which sounds a bit like the MTE program listed in
  the Pirated Commercial Software section.  Any information would be
  appreciated.

  
| And, finally, I have at last received information on a file called 
| ALF.ZIP, as you can see in the pirated files section.  This is a 
| commercial game, however, and is not related to the file that was 
| previously reported here.  That one was apparently a false alarm, and has 
| been removed from the report.
  
  ========================================================================

                               Clarification

| In the last issue, I mistakenly referred to Kim Miller (1:103/700) 
| repeatedly as "she."  I have since been informed that I was caught by a 
| "stealth" name and was referring to Mr. Miller with the wrong gender 
| pronoun.  I extend my deepest apologies to Mr. Miller for getting things 
| mixed up.
  
  ************************************************************************

                                Conclusion

  If you see one of these on a board near you, it would be a very friendly
  gesture to let the SysOp know.  Remember, they can get in just as much
  trouble as the fiend who uploads pirated files, so help them out if you
  can.


                          ***HACK SQUAD POLICY***

  The intent of this report is to help SysOps and Users to identify
  fraudulent files.  To this extent, I give credit to the reporter of a
  confirmed hack.  On this same note, I do _not_ intend to "go after" any
  BBS SysOps who have these programs posted for d/l.  The Shareware World
  operates best when everyone works together, so it would be
  counter-productive to "rat" on anyone who has such a file on their board.
  Like I said, my intent is to help, not harm.  SysOps are strongly
  encouraged to read this report and remove all files listed within from
  their boards.  I can not and will not take any "enforcement action" on
  this, but you never know who else may be calling your board.  Pirated
  commercial software posted for d/l can get you into _deeply_ serious
  trouble with certain authorities.

  Updates of programs listed in this report need verification.  It is
  unfortunate that anyone who downloads a file must be paranoid about its
  legitimacy.  Call me a crusader, but I'd really like to see the day that
  this is no longer true.  Until then, if you _know_ of a new official
  version of a program listed here, please help me verify it.

  On the same token, hacks need to be verified, too.  I won't be held
  responsible for falsely accusing the real thing of being a fraud.  So,
  innocent until proven guilty, but unofficial until verified.

  Upcoming official releases will not be included or announced in this
  report.  It is this Co-Moderator's personal opinion that the hype
  surrounding a pending release leads to hacks and Trojans, which is
  exactly the opposite of what I'm trying to accomplish here.

  If you know of any other programs that are hacks, bogus, jokes, hoaxes,
  etc., please let me know.  Thanks for helping to keep shareware clean!

Lee Jackson, Co-Moderator, FidoNet International Echo SHAREWRE (1:382/95)