FW: PKZIP300 trojan horse

Subject: FW: PKZIP300 trojan horse
From: Moshe Koenig <alsacien -at- NETVISION -dot- NET -dot- IL>
Date: Wed, 14 Aug 1996 13:33:43 PDT

This message was circulated in our local list in Israel. It may
be of interest.
---------------Original Message---------------
Fellow tech-shoret list members,

I researched the PKZIP300 issue in order to pass whatever authoritative
information might be available along to my Flight Simulation list. All of
the FS list members rely heavily on the use of zipped downloads. Below is
posting, just as I sent it to that list.

Shmuel Ben-Artzi
sba -at- netmedia -dot- net -dot- il

The PKZIP300 trojan horse is not exactly new. Perhaps the current interest
in it was spawned by the fact that it celebrated its first birthday last
month. According to Symantec's virus database (definitely one of the *most*
authoratative references on the subject), it is not technically a virus,
rather a trojan horse. You must run the program to activate it. Once
activated, however, it works to format your hard disk, thereby destroying
all data on it. According to Symantec, charges that it can affect modem
operation are *not* true.

The following comes from PKWARE, the makers of PKZIP:
"It has come to the attention of PKWARE that a fake version of PKZIP is
being distributed as PKZ300B.ZIP or PKZ300.ZIP. It is not an offical version
from PKWARE and it will attempt to erase your hard drive if run. It attempts
to perform a deletion of all the directories of your current drive. If you
have any information as to the creators of this trojan horse, PKWARE would
be extremely interested to hear from you. If you have any other questions
about this fake version, please email support -at- pkware -dot- com"

The apparent misinformation about affecting a modem nonwithstanding,
PKZIP300 *is malicious and destructive if activated*. Don't download it.
Don't unzip it. Don't use it.

PKZIP from PKWARE itself is an excellent product and many of out group use
it, especially since zipped files play such an important part in simming.
But download it ONLY from recognized FTP sites.

Hope this clarifies matters.


----------End of Original Message----------

TECHWR-L List Information
To send a message about technical communication to 2500+ list readers,
E-mail to TECHWR-L -at- LISTSERV -dot- OKSTATE -dot- EDU -dot- Send administrative commands
ALL other questions or problems concerning the list
should go to the listowner, Eric Ray, at ejray -at- ionet -dot- net -dot-

Previous by Author: I Started It, So I Finish It
Next by Author: More Endings Than 1812 Overture
Previous by Thread: Thank you!
Next by Thread: FrameMaker problem: superscript in table cells

What this post helpful? Share it with friends and colleagues:

Sponsored Ads