Category : Tutorials + Patches
Archive   : PKTROJAN.ZIP
Filename : PKTROJAN.TXT

TROJAN WARNING

To all callers who might have downloaded PKPATCH.arc here or from any other
BBS .... Some users have found problems with hard disk crashes after/during
use of the patch. Read the following, and check your file. I would
(conservatively) not use either patch, and heed Phil's warning on the use of
PKARC on large binary files ........

-----------------------------------------------------------------------------
The following is a message from Phil Katz author of PKX35A35 regarding a users
questioning of a patch for same that has been circulating around the boards...
------------------------------------------------------------------------------

DO NOT RUN THAT PATCH THAT YOU UPLOADED!!!

It is *definetly* a trojan!

It is a copy of an actual article posted by me on USENET, with one line
different. That line is the patch for PKXARC.COM. This has obviously
intentionally been done as a very sick joke. The debug patch that you uploaded
will write to direct sectors as you figured, and from what I can tell, will
wipe out the FAT or Master Boot Record for drive C:. BAD NEWS!

The PKXARC patch that I posted should be as follows:

debug pkxarc.com
e 1d0b 8b 3e c8 f4 80 3e d0 f5 0c 75 06 e8 a9 06 eb 1a 90 aa
w
q

What was in the file you uploaded was:

debug pkxarc.com
e 1d0b b8 02 00 b9 ff 00 ba 00 00 cd 26 90 e9 fa ff 1a 90 aa
w
q

As you can see, what you uploaded was quite different than what I originally
posted.

Please inform the sysop of ANY system where you see that file to check it,
delete it if necessary and inform users...


------------------------------------------------------------------------------
The following is a message from Phil Katz author of PKX35A35 regarding a
TROJAN PKXARC that has been circulating around the boards...
------------------------------------------------------------------------------

From: PHIL KATZ
To: ALL
Subj: TROJAN PKXARC

c: ARC+ZOO+ #1002 12-27-87 23:16 (Read 0 times)
f: PHIL KATZ (REBEL LEADER)
t: ALL
s: TROJAN ALERT

cc: SYSOP

12/27/87

There have recently been several trojan/hacked/pirated versions of
PKARC/PKXARC showing up.

The most vicious of the bunch is called NEWARKR.EXE. This is a (PKSFX) self-
extracting file, but contains no DOCS. The programs PKXARC, PKARC, and PKSFX
have been renamed to XARKR, ARKR, and RKSFX respectively. The PKWARE copyright
has been removed from these programs, along with PKWARE's address and all
references to ShareWare. The Copyright notice has been replaced with the
phrase "Public Domain Software". These programs have been modified in other
means too, and their reliability is unknown.

Equally malicious, there has been a trojan patch for PKXARC that has been
cirulated. It is a copy of a valid message from me posted on USENET, except
the patch given in the message has been changed to write directly to the FAT
and wipe out disk C.

There have been also various files circulated claiming to be PKARC/PKXARC
versions 3.6 and 5.3. These are all hacked or pirated.

The perpetrators of these hacks are guilty of Copyright infringement, theft,
libel with malice, or other applicable crimes. PKWARE Inc. will seek to
prosecute these individuals to the fullest extent of the law.

If you see any file claiming to be a new version of PKARC/PKXARC or a patch to
those programs, and are unsure of their origin, please check the following
BBS's for the authentic files:

PKWARE BBS 414-352-7176
EXEC-PC 414-964-5160
RBBS OF CHICAGO 312-352-1035
SOUND OF MUSIC 516-536-8723

If you do encounter any hacked or pirated files, please inform the SYSOP of
the system with these files to delete them immediately. Please also inform
PKWARE inc. of these files, their origin, and all other information that you
have available. We can be reached at either any of the above BBS numbers, or
414-352-3670 voice. Only with your help can these very sick individuals be
prevented from causing harm to unsuspecting victims of these hacked and
pirated programs.

>Phil Katz>