Date:  Thu, 11 Apr 1996 01:31:39 -0700

From:  Rudy Troike <RTROIKE[AT SYMBOL GOES HERE]CCIT.ARIZONA.EDU>

Subject: Virus alert II



The report of the PKZIP300 virus is correct. It's not a hoax, and

it's very nasty. It's a "trojan horse" virus that will try to reformat

your hard drive (thus erasing anything that's already on your hard

drive). It has been around since May/June 1995 but has popped up again

rather often in recent weeks.



That said, you're not likely to be in much danger. If you don't know

how to download an executable file from a BBS or dubious FTP site, then

you can't get this virus. (And if you're a Mac user, you wouldn't be

able to get the virus without some serious effort.) If you use your VAX

or Unix account for routine e-mail, Web browsing, etc., you're not at

any risk at all. If you do know how to download files, and if you

download them only from responsible academic and commercial sites, then

you're more likely to be struck by lightning or to win the Arizona

lottery than to contract a virus. (Just stay away from BBS sites, in

which you probably don't have the slightest interest anyway.)



The hook is that version 2.x of PKZIP is a very good and necessary

utility for PC users who wish to download and use compressed (or

"pkzipped") files. So these users now see that version 3.x of PKZIP

(which is what PKZIP300 means) is available and figure that it must be a

new, better update. They download it to their personal machines, and

then--disaster.



--Carl Berkhout