Doom II Virus Information   by Independent (IND)

┌─▄ ▄ ▄ │ █ ▄─┐ ▄─┐ ┬─▄─▄ █ █ │ █ █ │ █ │ │ █ █ █ █ └─▀ ▀─┘ ▀─┘ ┴ ▀ ▀ ▀ ▀ H E L L O N E A R T H Virus information Updated Oct. 3rd 1994 PLEASE TAKE WHAT YOU ARE ABOUT TO READ VERY SERIOUSLY. IT SEEMS PEOPLE LIKE SPREADING AND CHANGING FACTS. THIS FILE IS GENUINE, SO PLEASE TAKE ITS CONTENTS SERIOUSLY. There has been a file spread around on BBS's about the virus in doom II, but we found out it is not complete, so we will give you details about the virus. To make things clear now, only the PIRATED *REGISTERED* version of DOOM II has this virus, and not the one you would buy direct from ID Soft, so whoever spread the rumor that some guy at ID soft or some guy at Internet who wrote "I sent a virus..." we think this is bullshit. In fact it is to our knowledge that ALL copies of DOOM II found on BBSs have this special trojan. Actually, some copies even have viruses, but all of them have one thing in common. Why do we say trojan ? because it's an encrypted NESTED program that is executed when you load DOOM II, so it is not a virus per se. It goes undetected by ALL the virus scanners out there, even VSAFE, since the program runs in protected mode and requires 3.7 megs! When DOOM2.EXE is run, before executing the actual DOOM, this small encrypted program is run, it checks for the date, if it is Oct 10 and higher, it will activate. If not, it will execute the game! Some say it will even erase or ruin your partition table! WHAT IF ... you changed your date past or before Oct. 10! Easy assumption! You won't succeed, since the special trojan contains a counter, and one time or another it will trigger itself! Now, you might've seen some files on your favorite BBSs claiming to remove the viruses found in DOOM II! Beware, they are *FAKES*! There is a lot of different sayings about this. Some say it's not true, some say the virus goes off on Oct. 10, some say it goes off anytime, etc... Some even say there is this virus that calls U.S. all night long! That one is pure bullshit, a hoax just to scare people! Can't beleive people can be so DUMB to beleive that! What should you do ? We are doing efforts in getting more information about this nested program, but the problem is, this trojan is highly encrypted and is part of DOOM shell itself, so we are in the process of re-writing the DOOM2.EXE file completly, filtering out this nested trojan with "NOP"'s... And we will make it available for you pretty soon! For the time being, make a backup of all your important files on your HD, use VSAFE to write-protect your HD at all times... - Milbourne