Path: utzoo!utgpu!utstat!jarvis.csri.toronto.edu!mailrus!tut.cis.ohio-state.edu!ucbvax!agate!garnet.berkeley.edu!bmug
From: bmug@garnet.berkeley.edu (BMUG)
Newsgroups: comp.sys.mac
Subject: Trojan Horse Warning
Keywords: AntiToxin, Virus
Message-ID: <21814@agate.BERKELEY.EDU>
Date: 19 Mar 89 01:21:46 GMT
Sender: usenet@agate.BERKELEY.EDU
Organization: University of California, Berkeley
Lines: 22
References:


WARNING:  We have discovered the existence of a "Trojan Horse" in a
bogus upgrade to Anti-Toxin, a virus-detecting INIT from Mainstay.
The INIT, labelled as version 2.0 in the Get Info box, attempts to
format your disk and rename it "Scored!".

A couple variations of this INIT have been reported. The one we have
seen has a size of 2,276 bytes, created Fri, Jan 13, 1989, 3:05PM, and
modified Mon, Mar 6,1989, 12:03AM. A quick inspection of the disassembled
code of the INIT indicates that it does nothing until the clock time
on your mac is after Mar 13, 1989, 5:20PM. The perpetrator obviously
wanted the Trojan Horse to lie dormant for a few days, giving it a
chance to spread to more users.

Although I believe Anti-Toxin is a commercial product, this bogus
version has apparently been uploaded to several bulletin boards.
Watch out!
                                                             /\
BMUG                      ARPA: bmug@garnet.berkeley.EDU    A__A
1442A Walnut St., #62     BITNET: bmug@ucbgarnet            |()|
Berkeley, CA  94709                                         |  |
(415) 549-2684                                              |  |