AOL4Free trojan horse-Put "DELTREE.EXE " on a floppy disk!

[Horace Greeley]

Warren and list,

While not a direct issure re: trojan horse  issues, a further thought
occurs to me along these lines.

For those still stuck in the basic DOS environment, and, prehaps, unsure of
their own skill level, I'd suggest making a special DOS boot disk.
This disk, in addition to basic DOS system files for booting, could also
contain DELTREE, FORMAT, FDISK, and a few other potentially dangerous
programs, which could then be eliminated from the DOS directory on the hard
disk.

For machines in public places, one could also lock down things a bit
farther by removing EDIT and QBASIC (to the boot disk) and inserting
BREAK=OFF in the config.sys file.

Too much computer stuff!

I know that it's a subject for jokes, but these virus outbreaks can be
devastating, if one is not prepared.  Thus, I sort of apologize for
continuing this digression from the main topic of the list, but
respectfully submit that a timely reminder about our mutual vulnerability
is not out of place.

Best to all, in our thoroughly fire-walled, virus-free, politically-correct
fiefdoms.

Horace



At 06:49 AM 4/27/97 -0700, you wrote:
>More on the AOL4Freee Trojan Horse  from Symantec Corp.
>
>This trojan horse program is not the same as, and should not be confused
>with, the AOL4Free Virus Hoax. A virus hoax message was distributed in
>the same timeframe (March 1997) under the same name.
>
>The AOL4Free Trojan Horse program first reported as being distributed
>through America Online e-mail in early March 1997. This executable file
>is actually converted from a batch file using DOS utility BAT2EXEC
>version 1.5. This Utility is commonly used to convert large batch files
>to COM files to enhance speed.
>
>     This trojan first searches for the DOS program "DELTREE.EXE" is in
>various directories and then it uses it to delete all files from the
>user’s C drive. After completion, it displays the DOS error message "Bad
>Command or file name" and continuously displays an obscene message. This
>trojan cannot delete the files from the C drive if it is unable to find
>DELTREE.EXE, but the obscene message will always display.
>
>     This trojan will work on both DOS and Windows 95 environments [[as
>long as DELTREE.EXE is present and accessible.]]  Take it off your hard
>drive and put on a floppy disk!  WDF
>
>     For more information see:
>http://ciac.llnl.gov/ciac/bulletins/h-47a.shtml
>--
>Home of The Humor List
>Warren D. Fisher
>fish@communique.net
>Registered Piano Technician
>Piano Technicians Guild
>New Orleans Chapter 701
>
>
Horace Greeley

Stanford University
email: hgreeley@leland.stanford.edu
voice mail: 415.725.9062
LiNCS help line: 415.725.4627