I reckon you folks may or may not know about this but the thread
is in the dos and dos binaries newsgroups. Concerns Arachne 1.66 with
some confirmations by other users.
*****
From: Ringo <[EMAIL PROTECTED]>
Newsgroups: alt.binaries.warez.ibm-pc.dos,alt.binaries.warez.ibm-pc.old,alt.msdos
Subject: Arachne has a Destructive V!RUS!!!! (More detail)
Date: 17 Aug 2000 19:31:17 -0500
Be careful. I installed and ran Arachne for DOS and it had a
destructive stealth virus on it! Oddly enough, it's very own core file
core.exe deleted my entire C:\DOS directory and left a message that
read "Would you like to have some coffee ?" in a 36byte file titled
"donotpan.ic!"
It came in the self-extracting EXE archn166.exe from
http://browser.arachne.cz
Norton and Macafee do not recognise it as a threat. Yet it deleted all
of that directory. I sent the file to Norton and their automated
system says they were unable to find malicious code in the file.
However, core.exe contains both strings
But that's not all! Take a good look at CORE.EXE in a hex editor. Look
at byte offset 000308A9! It contains a barrage of obscenities and
later on offset 000309D5 it turns into:
"HANDIwantYourKisstolastforeverILOVEUiLOVEUiLoveuIwannAknowHowUfeelIneed__
someONEtosavemeIFEELsolonelyIFEELsoSAD! LsDtHcXtcyLsDtHcXtcyLsDEEEE
JesuswastheonlysontellmeImthechosenone" and on and on and on....
*****
I suppose someone had some fun.
Virus detection or older trojan programs won't detect it.
Word has it Michael Polak has been notified.
Since only that guy had a destructive outcome others have only
verified the silly text strings.
No doubt a short-lived problem.
Marc
To unsubscribe from SURVPC send a message to [EMAIL PROTECTED] with
unsubscribe SURVPC in the body of the message.
Also, trim this footer from any quoted replies.
More info can be found at;
http://www.softcon.com/archives/SURVPC.html
