🚀 go-pugleaf

Hello, everybody!

As most MS-DOS users probably know, the very popular archiver PKZIP
from PKWare Inc. has not been updated from version 1.10 since about
two years. The new version was in "about to be released final
beta-test" during more than a year. This, of course, caused a lot of
bogus, hacked, or trojanized versions to be released by malicious
people to fool the legitimate users. The number of hacks is probably
above 10.

A few days ago, PKWare finally decided to release a new version of
their archiver, called 2.04c. Regardless of the long developpment
period, the program turned out to contain a few minor bugs and even
errors in the documentation. But this is not so interesting from the
computer virus point of view... :-)

What is interesting is that somebody used an out-of-date version of
Symantec's Norton Anti-Virus to scan the new archiver. It seems that
this version causes a false positive - the program is flagged as
infected by Maltese Amoeba. The confusion is increased by the fact
that all executables in the package are self-compressed with PKLite
1.20. This caused the heuristic scanner of F-Prot to report that those
files are suspicious, because they contain a program that modifies
itself in memory (of course - the decompressor unpacks the compressed
code) - something often used by viruses.

As a result, a major hoax was started; the archiver was several times
uploaded and deleted at wuarchive.wustl.edu; and the number of
messages about that in comp.compression is reaching the record caused
by the famous posting that informed about the claims of a company to
produce an archiver which is able to achive compression rate of 16:1
for any file... :-)

I obtained a copy of the new version of PKZIP, examined it manually
with a debugger, and scanned it with about a dozen scanners. The
result is that NONE OF THE EXECUTABLE FILES IS INFECTED. Even a recent
version of NAV (2.1 with signature updates of December) does not
report the false positive any more. PKWare has confirmed that this is
a "real" version.

So, please done's pay attention to the rumors, if they reach you. The
VALIDATE codes of the self-unpacking archive containing the new
version of PKZIP is:

          File Name:  PKZ204C.EXE
               Size:  188,818
               Date:  1-5-1993
File Authentication:
     Check Method 1 - 0DC8
     Check Method 2 - 045E

The actual Date: field may be different; it was destroyed while I was
downloading the file.

Regards,
Vesselin
- -- 
Vesselin Vladimirov Bontchev          Virus Test Center, University of Hamburg
Tel.:+49-40-54715-224, Fax: +49-40-54715-226      Fachbereich Informatik - AGN
< PGP 2.1 public key available on request. > Vogt-Koelln-Strasse 30, rm. 107 C
e-mail: bontchev@fbihh.informatik.uni-hamburg.de    D-2000 Hamburg 54, Germany