exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

a-06.ciac-norton-utilities-trojan-horse

a-06.ciac-norton-utilities-trojan-horse
Posted Sep 23, 1999

a-06.ciac-norton-utilities-trojan-horse

tags | trojan
SHA-256 | 3a82d417b951d6e36665d077268e28a4b657a1966f80a724e6fca839b12bb0e3

a-06.ciac-norton-utilities-trojan-horse

Change Mirror Download

FOR OFFICIAL DEPARTMENT OF ENERGY USE ONLY
________________________________________________________________________
THE COMPUTER INCIDENT ADVISORY CAPABILITY

CIAC

INFORMATION BULLETIN
________________________________________________________________________

Information about a trojan horse in Norton Utilities for IBM
PCs and clones

November 7, 1989, 1730 PST Number A-6


CIAC has been informed that a trojan horse has been found in a number
of IBM PCs and PC clones which run Norton Computing utilities. This
trojan horse appears superficially to be a legitimate file within
Norton Utilities named either NORTSTOP.ZIP or NORTSHOT.ZIP. (The file
contents are the same, regardless of the name used.) The trojan horse
program must be run (i.e., the EXE file for the program must be
executed) for any damage to occur to your system. If run, the program
lists the directory and displays a message that one's machine is free
of viruses. Damage resulting from running this program occurs only if
the trojan horse program is executed between December 24 and December
31 inclusive. In this case, the program will erase files with
selected file extensions.

Detection

You can detect this trojan horse by using Norton Utilities to examine
the .EXE file for either of the.ZIP files listed above. The EXE file
will contain the following message:

The Norton Public Domain Virus Utility, PD Edition 5.50, (C) 1989
Peter Norton

Your System has been infected with a Christmas virus! Selected
files were just eliminated! Without these files, you might as well
use your computer as a damn, boat anchor! If you do NOT own a
boat, you may want to replace the files which were just erased.
Try to determine which files they were. HARDY HA! HA! HA! HOW
DO YOU FEEL NOW; YOU IDIOT? MERRY CHRISTMAS AND HAPPY NEW YEAR!

If your system has the trojan horse, you will obtain a report similar
to the following when using PKUNZIP (a utility which separates and
decompresses files):

1065 Implode 650 39% 10-04-89 12:26 9778978d --w READ-ME.NOW
38907 Implode 30156 23% 10-02-89 11:57 c333dec0 --w NORTSHOT.EXE
----- ------ ----- ---------------
39972 30806 23% 2


Eradication

If you should discover this trojan horse, do not execute the file
NORTSHOT.EXE. Please make a copy of the bogus .EXE and .ZIP files on
a diskette before you do anything else. Eradicating the NORTSTOP.ZIP
and NORTSHOT.ZIP trojan horse is straightforward; simply use your disk
operating system to delete all files named NORTSHOT.EXE and the .ZIP
file that created it. Please then send the diskette to CIAC at the
address below as soon as possible.

Note

According to information provided to CIAC, this trojan horse is not
found in the version of Norton Utilities sold in commercial software
outlets. It is only found in versions of Norton Utilities available
from public sources (e.g., bulletin boards).

NORTSTOP.ZIP and NORTSHOT.ZIP are not viruses. They will not
replicate themselves and spread from machine to machine. Once you have
removed this trojan horse, it can only be reintroduced by copying the
files once again from public sources.

To send copies of the trojan horse, or to obtain further information
about this problem, please contact:

Tom Longstaff, CIAC
Lawrence Livermore National Laboratory
P.O. Box 808, L-540
Livermore, CA 94550
(415) 423-4416 or FTS 543-4416

Send electronic mail to: ciac@tiger.llnl.gov

CIAC FAX: (415) 422-4294 FTS 532-4294

Login or Register to add favorites

File Archive:

October 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Oct 1st
    10 Files
  • 2
    Oct 2nd
    0 Files
  • 3
    Oct 3rd
    12 Files
  • 4
    Oct 4th
    15 Files
  • 5
    Oct 5th
    18 Files
  • 6
    Oct 6th
    0 Files
  • 7
    Oct 7th
    0 Files
  • 8
    Oct 8th
    0 Files
  • 9
    Oct 9th
    0 Files
  • 10
    Oct 10th
    0 Files
  • 11
    Oct 11th
    0 Files
  • 12
    Oct 12th
    0 Files
  • 13
    Oct 13th
    0 Files
  • 14
    Oct 14th
    0 Files
  • 15
    Oct 15th
    0 Files
  • 16
    Oct 16th
    0 Files
  • 17
    Oct 17th
    0 Files
  • 18
    Oct 18th
    0 Files
  • 19
    Oct 19th
    0 Files
  • 20
    Oct 20th
    0 Files
  • 21
    Oct 21st
    0 Files
  • 22
    Oct 22nd
    0 Files
  • 23
    Oct 23rd
    0 Files
  • 24
    Oct 24th
    0 Files
  • 25
    Oct 25th
    0 Files
  • 26
    Oct 26th
    0 Files
  • 27
    Oct 27th
    0 Files
  • 28
    Oct 28th
    0 Files
  • 29
    Oct 29th
    0 Files
  • 30
    Oct 30th
    0 Files
  • 31
    Oct 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close