Article 85816 of comp.sys.amiga.misc:
Path: news.PEAK.ORG!news.orst.edu!wsrcc.com!wetware!olivea!hookup!gatech!newsxfer.itd.umich.edu!agate!tcsi.tcs.com!uunet!in2.uu.net!comp.vuw.ac.nz!actrix.gen.nz!tower!johnv
Newsgroups: comp.sys.amiga.misc
Subject: Virus_Checker 6.60 trojan
From: johnv@tower.actrix.gen.nz (John Veldthuis)
Message-ID: <johnv.11r4@tower.actrix.gen.nz>
Date: Mon, 31 Jul 95 18:46:27 +1200
Organization: Amiga Virus Extermination Services, TAUG
Lines: 51

I have been taking a look through the 6.60 trojan that is going around. It
seems the person or persons involved are not that smart.
They obviously could not find the checksum code. Because as soon as you
run it it tells you it has been hacked.

The other interesting thing is that it is actually a real 6.57 version of
Virus_Checker. Again they where obviously unable to find the hidden
internal version number. In fact had anyone used the About requester it
would have told them what version it really was.

Another thing is (as Jan pointed out) it fails on the PGP signature checks.

Now for everyone. If you want to be 100% sure of the version of
Virus_Checker you are getting is a real one.

1.  Get it from Aminet. It is only allowed to be uploaded there by myself
or someone I tell them about personally.

2.  Get and learn to use PGP. My Public key should now be on the PGP
servers. You can use it to make sure that it is a release from me. All
releases will have these signature files in them. Below is my public key.


3.  If really suspicious, lock up all the drives. Take to Virus_Checker
with an editor of some kind and change the version string. If it says 7.1
then change it to read 7.2. Then save it (CygnusEd or something like it).
Run VC and it should warn you it has been hacked. If it does not then it is
a fake one.

-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: 2.6.2i

mQCNAi6h70wAAAEEANWu8csrvc6Z/JY21kiJwklSIDVltJKlxNGU47AFrIGUTcSD
12WNXFKSn/wdjVLJ6ATgRBeErtxPj8t9p7ple4/cN8uziYzC0gFbQdfH/CmcrM0e
sPQJxcmkUiFG7BpENF9uqS2hNyL1HL4xHOwFXcN1PUZflGxtaQ0mtYy7jZfBAAUR
tCpKb2huIFZlbGR0aHVpcyA8am9obnZAdG93ZXIuYWN0cml4Lmdlbi5uej6JAHUD
BRAurJ3meXjB5OBD6aEBASAQAv46FGU1aiWZv3YCPsyDxUIfYe7Lz8iPnyJmLKec
QDlESHfac/9OuBQvp1KIUWDBFFLt+jOpEzZbCHkNWmgJtF8JhGjzJ6EUn3Z75nps
BbT6MJNYGptCQ3+xhTuTGBdun4CJAJUCBRAuskv2oNrznbERpEEBAS2qA/9GpqEY
N43g7kDZbWN8kxlFPhcIuDRRnZquLu/kdCyPMW0ZQ6SNWp+1+1J/MNdPVVmRvzxa
csnAmeKFDGfWATr3v5Z9aWRsfxCUQI0+lT5IAqzxyjlD5vexvd1+wytXVisDcqMD
djoZqbZmCL7cMBGerh1oWOD9AhiHqzTCx6/x44kAlQIFEC6wfvMNJrWMu42XwQEB
oBsD/0xFuFxRRBvd1d94oTbMyBYensOB8iVPEE06W4Ai+CN4bUrwsEH0bossz51p
XtekSA4BgpTWt9xthr0S2N1jQwNbcmBOG+rkA0hrhTafX1jRr55zNJk38eeCwJCm
dGI5Z5xYLnzYe4hP5ToL1vTYQq+ZkMGZeZxTE/MAT5rr/I1F
=1nZv
-----END PGP PUBLIC KEY BLOCK-----
--
johnv@tower.actrix.gen.nz |    Author of        |PGP FingerPrint
PGP Public Key available  |  Virus_Checker      |2A 41 F4 EC 7C D7 D3 DC
                          |                     |57 DE 64 9A 4E 9E D3 E8