CIAC A-06

eZine lover (@eZine)

Published in 

The Computer Incident Advisory

 · 4 years ago

  

 
           FOR OFFICIAL DEPARTMENT OF ENERGY USE ONLY 
________________________________________________________________________ 
            THE COMPUTER INCIDENT ADVISORY CAPABILITY 

                             CIAC 

                     INFORMATION BULLETIN 
________________________________________________________________________ 

    Information about a trojan horse in Norton Utilities for IBM  
                         PCs and clones 

November 7, 1989, 1730 PST                                 	Number A-6 
  

CIAC has been informed that a trojan horse has been found in a number 
of IBM PCs and PC clones which run Norton Computing utilities.  This 
trojan horse appears superficially to be a legitimate file within 
Norton Utilities named either NORTSTOP.ZIP or NORTSHOT.ZIP.  (The file 
contents are the same, regardless of the name used.)  The trojan horse 
program must be run (i.e., the EXE file for the program must be 
executed) for any damage to occur to your system.  If run, the program 
lists the directory and displays a message that one's machine is free 
of viruses.  Damage resulting from running this program occurs only if 
the trojan horse program is executed between December 24 and December 
31 inclusive.  In this case, the program will erase files with 
selected file extensions. 

Detection 

You can detect this trojan horse by using Norton Utilities to examine 
the .EXE file for either of the.ZIP files listed above.  The EXE file 
will contain the following message: 

	The Norton Public Domain Virus Utility,  PD Edition 5.50,   (C) 1989 
	Peter Norton 

	Your System has been infected with a Christmas virus! Selected 
	files were just eliminated!  Without these files, you might as well 
	use your computer as a damn, boat anchor!  If you do NOT own a 
	boat, you may want to replace the files which were just erased. 
	Try to determine which files they were.  HARDY   HA!  HA!  HA!  HOW 
	DO YOU FEEL NOW; YOU IDIOT?  MERRY CHRISTMAS AND HAPPY NEW YEAR! 

If your system has the trojan horse, you will obtain a report similar 
to the following when using PKUNZIP (a utility which separates and 
decompresses files): 

1065   Implode   650    39%    10-04-89   12:26   9778978d  --w  READ-ME.NOW 
38907  Implode   30156  23%    10-02-89   11:57   c333dec0  --w  NORTSHOT.EXE 
-----           ------ -----                                  --------------- 
39972           30806   23%                                            2 

 
Eradication 

If you should discover this trojan horse, do not execute the file 
NORTSHOT.EXE.  Please make a copy of the bogus .EXE and .ZIP files on 
a diskette before you do anything else.  Eradicating the NORTSTOP.ZIP 
and NORTSHOT.ZIP trojan horse is straightforward; simply use your disk 
operating system to delete all files named NORTSHOT.EXE and the .ZIP 
file that created it.  Please then send the diskette to CIAC at the 
address below as soon as possible. 

Note 

According to information provided to CIAC, this trojan horse is not 
found in the version of Norton Utilities sold in commercial software 
outlets.  It is only found in versions of Norton Utilities available 
from public sources (e.g., bulletin boards). 

NORTSTOP.ZIP and NORTSHOT.ZIP are not viruses.  They will not 
replicate themselves and spread from machine to machine.  One you have 
removed this trojan horse, it can only be reintroduced by copying the 
files once again from public sources. 

To send copies of the trojan horse, or to obtain further information 
about this problem, please contact: 

Tom Longstaff,  CIAC 
Lawrence Livermore National Laboratory 
P.O. Box 808, L-540 
Livermore, CA  94550 
(415) 423-4416 or FTS 543-4416  
  
Send electronic mail to: ciac@tiger.llnl.gov 

CIAC FAX: (415) 422-4294 FTS 532-4294