💾 Archived View for spam.works › mirrors › textfiles › computers › hsdiag.res captured on 2023-06-14 at 16:03:14.
-=-=-=-=-=-=-
=========================================================================
||
From the files of The Hack Squad: || by Lee Jackson, Moderator, FidoNet
|| Int'l Echos SHAREWRE & WARNINGS
The Hack Report || Volume 2, Number 5
File Test Results || Result Report Date: April 10, 1993
||
=========================================================================
*************************************************************************
* *
* The following test was performed by R. Wallace Hale, sysop of the *
* Driftnet BBS, (506) 325-9002. The results, forwarded by *
* James FitzGibbon (FidoNet 1:250/301) and HW Bill Lambdin, are *
* preliminary. Thanks to everyone for their assistance. *
* *
*************************************************************************
HSDIAG.ZIP WARNING!!!
~~~~~~~~~~~~~~~~~~~~~
The file HSDIAG.ZIP, masquerading as a high speed modem diagnostic
utility is a Torjan horse.
This is a PRELIMINARY report and will be expanded and/or modified
(and probably corrected) in due course.
I received HSDIAG from Bob Feldman today, and have not had sufficient
time to disassemble HSDIAG.EXE completely, but I have done enough to
determine that the program will overwrite the first 255 sectors on the
first eight drives on a system!
The Trojan begins with the highest number drive and works downward,
finishing with the floppy diskette in Drive A, if such exists. In
addition to data loss, the system will no longer be bootable from
the hard drive.
Error messages are suppressed and once started, the Trojan can NOT
be halted by a Ctrl-C or Ctrl-Break key sequence.
No virus scanner in my arsenal twigs to the Trojan, nor does
F-PROT 2.07 in heuristic mode find anything suspicious. This is
not at all surprising, and one shouldn't expect any virus scanner
to provide protection against Trojan programs.
However, tired old PROGNOSE warns of possible danger.
The following strings can be found in HSDIAG.EXE:
18C: High Speed Modem Diagnostics
1B6: Version 1.0
1E0: Sound Blaster Support
232: ) Written by Bully Bros, Incoporated)
Please Press [ENTER] To Load Diagnostics,
287: Please wait ..
296: ..Loading Done!#Press [ENTER] to Start Diagnostics.
2CA: Bully Bros.Dallas TX.
2E0: -Copyrite (C) 1993 Bully Bros. Raj And Asshole
DF0: #$456789:;<=>?uRuntime error
E0E: at
The Trojan archive contents are:
Archive: HSDIAG.ZIP
Name Length Method SF Size now Mod Date Time CRC
============ ======== ======== ==== ======== ========= ======== ========
HSDIAG.EXE 4864 Deflated 34 3172 08 Mar 93 22:03:58 1C84FC4D
FILE_ID.DIZ 245 Deflated 7 228 17 Mar 93 02:02:50 7CF5CBD2
HSDIAG1.DAT 17264 Deflated 36 11044 27 Nov 92 13:47:34 46B34F7D
HSDIAG2.DAT 7121 Deflated 57 3012 27 Nov 92 13:47:34 7127D2C7
HELP.DAT 4064 Deflated 31 2802 27 Nov 92 13:47:34 6FD0DD60
UART1.DAT 5872 Deflated 39 3542 27 Nov 92 13:47:34 AFB5E3CE
HSDIAG3.DAT 2848 Deflated 50 1404 27 Nov 92 13:47:34 0089171B
============ ======== ======== ==== ======== ========= ======== ========