November/December 1994 Revised STEWS-IM-M (380-19a) MEMORANDUM FOR RECORD SUBJECT: Viral Infections in Commercial/Government Media/Software 1. The following list, compiled from VIRUS-L, RISKS-FORUM and other public sources, identifies virus infections transmitted through either commercial or government entities in which the distributor would generally have been considered to be a "reputable source". If anyone has additional incidents, I would appreciate receiving such information so that I may update this list. Any contributor will receive the appropriate credit. 2. I have consciously omitted those incidents in which there was suspicion that the reporting location was either suspect, unsure itself as to the source of the infection, or unwilling to provide full disclosure. I have added an asterisk * in front of an entry to denote new material from the previous month. 3. MS-DOS INFECTIONS SOFTWARE REPORTING LOCATION DATE VIRAL INFECTION a. Unlock Masterkey Kennedy Space Center Oct 89 Vienna b. SARGON III Iceland Sep 89 Cascade (1704) c. ASYST RTDEMO02.EXE Fort Belvoir Aug 89 Jerusalem-B d. Desktop Fractal Various Jan 90 Jerusalem e. Bureau of the Government Pringing Jan 90 Jerusalem-B Census, Elec. County Office/US Census Bureau & City Data Bk., 1988 f. Northern Computers Iceland Mar 90 Disk Killer g. Far Side Moon Japan Apr 90 NambaI/NambaII Artdink Inc. (PC Manufacturer shipped infected systems.) h. PC Today United Kingdom Jul 90 Disk Killer (Magazine distributed non-working copy of virus.) i. Modular Circuit Padgett Peterson Oct 90 Stoned Technology Utility Disk j. DOS-TREND Christoph Fischer Nov 90 Stoned II Germany (Magazine distributed infected disks in issue 10/11.) k. PC Benelux World David Ferbrache Nov 90 Cascade (1704) l. Shimadzu Photodetection Dr. Werner Klotzbuecher Nov 90 Vienna A Detector SPD-M6A, Germany Version 2.14 m. Joint Service Software Fred O'Kelley Nov 90 Stoned System (JSSS) El Paso, TX (Contractor installed financial system from an infected disk.) n. Arkanoid II Alex Jauch Nov 90 Jerusalem-B o. Modem Protocall Brian Daniel Dec 90 Stoned One Modem Evaluation Columbus, GA Novell IPX & NETBIOS Version (Distributed by LAN Source Technologies Distributing) STEWS-IM-M (380-19a) November/December 1994 SUBJECT: Viral Infections in Commercial/Government Media/Software p. COMBASE and SVGA- Michael Head/ Dec 90 Music Bug UTILITY R. Wallace Hale q. A-MAIL VCH BIBLIO Lynne Munro Mar 91 1701/1704 Disk 2 of 2 Oxford University r. Oracle Windows' DDE/ Sam Daniel Jul 91 Stoned Toolbox Demo Disk Unisys s. European Patent Office Iain Noble, UK Aug 91 Stoned Bulletin Disk (Reported in New Scientist, 10 Aug 91) t. Sun Microsystems DOE CIAC Bulletin B-40 Sep 91 Jerusalem-B PCNFS 3.5b Karyn Pichnarczyk u. Cypress Semiconductor Padgett Peterson Sep 91 Stoned MAXPROG, version 2.72C v. PUMPKIN PATCH Screen Various Oct 91 Jerusalem-B Saver, Publishing International w. PC Paintbrush (update John-David Childs Oct 91 Michelangelo disk from Z-Soft/one) University of Montana user report only) x. Software Perspectives' John Kida Nov 91 Stoned Demo Disk for Extensions to Cliper y. NTIS Software Distri- Various Nov 91 Stoned bution to 85 Federal (see article in Federal Computer Week, Offices November 4, 1991) z. Zinc Software C++ PCWeek, 25th Edition Nov 91 Forms Library Disk aa. Virtual Reality Lab PCWeek, 25th Edition Nov 91 Michelangelo Distant Suns Disk ab. Novell Network Support DOE CIAC Bulletin C-10 Dec 91 Stoned-3 Encyclopedia Disks Karen Pichnarczyk ac. Konami Inc. Space- John Markoff Dec 91 Stoned wrecked Game Disk NY Times ad. Software Preloaded in AISS Alert 91-18 Dec 91 Michelangelo AUVA 350/25 Systems and USAISC-AMC Memo Jan 92 (assembled in Taiwan/ Information Management Consultants, Brookfield, WI) ae. Software Preloaded in USAISC-AMC Memo Jan 92 Michelangelo Easy Data Model 386 Systems with Easy Data PCS from Trident VGA CO. af. Leading Edge Products NPR/San Francisco Jan 92 Michelangelo Preloaded Shipments Chronicle of 6,000 PCs from 10-27 Dec 91 2 STEWS-IM-M (380-19a) November/December 1994 SUBJECT: Viral Infections in Commercial/Government Media/Software ag. PC Fun Magazine Disk Nick FitzGerald Jan 92 Stoned New Zealand ah. Da Vinci Systems Various Feb 92 Michelangelo E-Mail 2.0 Demo Disk ai. Meridian Data Inc. Tim Martin Feb 92 Michelangelo CD-ROM Extension Alberta, Canada Software (Special Disk Shipment to One Site) aj. WIN Laboratory Virus-L Feb 92 Stoned Systems Preloaded with MS-DOS 4.01 ak. Sony Laser Library Virus-L Feb 92 Dark Avenger Distribution Disk al. IntelCorp LANSpool Peter Neumann Mar 92 Michelangelo 3.01 Disk SRI am. Symbol Technologies Chris Bray Mar 92 Michelangelo Preloaded Systems an. "Neural Networks & Bart Kosko Mar 92 Michelangelo Fuzzy Systems" Book-- Infected Disk Reported by Only One Site ao. Chicony Corporation John Qualtrough Mar 92 Michelangelo Keyboard Tracking Ball White Sands Software Disk ap. Pionex 386 Pro System Al Guiterrez Mar 92 Michelangelo DOS 5.0 Preloaded White Sands aq. Lotus Development Corp PCWeek Mar 92 Michelangelo CD/Networker, Lan March 9, 1992 Version ar. Netware Support Ken Haynes Mar 92 NoInt Encyclopedia (NSE) 900 Support/LAN Standard Edition-- Magazine Distributed by Novell as. Golden/Diamond Chris Mc Donald Jun 92 Fish Boot International/System White Sands Cactus OCR Disk at. DacEasy Inc. Instant PC Week Jun 92 Stoned Accounting Package June 29, 1992 (Vendor Confirmed) au. Phoenix Data Systems Tim Polk Jul 92 Michelangelo Diagnostic Disk for NIST Ethernet Board av. Standard Army Hazardous TRADOC Aug 92 Form Materials Tracking System Disk distributed by Wilson Hill Associates 3 STEWS-IM-M (380-19a) November/December 1994 SUBJECT: Viral Infections in Commercial/Government Media/Software ax. International Data James McLeod Aug 92 Stoned and Systems Preloaded Aberdeen Proving Michelangelo 486 Systems, Model IDS Ground, MD 4331 ay. Factory Sealed Device John Melka Oct 92 Michelangelo Driver Disks, ID Georgia Institute of PVGA 1024x, Reported Technology by one site az. Update Disk #48 for Ludwig Schumacher Oct 92 Michelangelo FAR-TRIEVE, distributed Mainz, Germany by CACI, INC-Federal ba. Data Disks Supplied by Rae Rollins Oct 92 Form Army Contractor White Sands (one site) bb. Physical Sciences Lab Chris Mc Donald Nov 92 Michelangelo Proposal Disk 92-A0117 White Sands (one site) bc. Star LC24 Print Driver Otto Stolz Dec 92 Vacsina Loader Disk (one site) (no replication) bd. FUJITSU Germany Printer Klaus Brunnstein Jan 93 V-Sign (CANSU) Disks VTC, University of Hamburg be. DCA Printer Driver Virus Bulletin Jan 93 NoInt Disks UK bf. Coleman Research Corp Chris Mc Donald Feb 93 Stoned Proposal Disk CEP/93- White Sands 001 (one site) bg. GTE Government Systems M. Hanzlik Mar 93 Stoned/ Corporation preloaded Ft. Belvoir Michelangelo 386SX/33, MS-DOS 5, Contract Number FO9603-91-0-0999 bh. Hoskyns' Project Virus Bulletin Apr 93 Form Manager Workbench with vendor confirmation Software bi. STIG 486 PCs preloaded James McLeod Jun 93 Stoned with virus on VGA Aberdeen Proving software diskettes Ground, MD (one site - - 50 systems) bj. Telemate Distribution Tapio Keihanen Jun 93 Butterfly File TM411-4.ZIP Virus-L/Winfred Hu Infected VESA Drivers (Author of Telemate) bk. COOP Supermarket game Harvey Stein Jul 93 Stoned/DIR-II disk, ZOOM, distributed Virus-L in Israel bl. CIX Online Service Iolo Davidson Jul 93 Butterfly posted infected file S&S International SPORT21C.ZIP. UK 4 STEWS-IM-M (380-19a) November/December 1994 SUBJECT: Viral Infections in Commercial/Government Media/Software bm. IBIS Training Class on Joe Reich Sep 93 Michelangelo Harvard Graphics dis- Fort Monmouth, NJ tributed infected disks to students. bn. Long-Term SLA Training Linda Hodgson Oct 93 Forms Class distributed disk Pine Bluff, AR to students. bo. So Much Shareware Vol Bill Lambin Dec 93 Power Pump II CD, PowerUser Software distributed infected file XYPHR2.ZIP. bp. Oliver Marketing INC. R. Wallace Hale Dec 93 Jerusalem B/ distributed demo disks (date of Stoned with two different report, infectors. not of incident) bq. PURS Program Disk Bas van der Most/ Feb 94 SatanBug distributed by 5th Jim Silsbee, MTMC Signal Command in Europe br. Die DFUe-CDROM Peter Immond Jun 94 Crusader distributed by Virus-L mediaplex bs. Nine Files on the Katherine Prouty Jun 94 Chill PBS Forum on ZiffNet ZiffNet Forums Manager 4. MACINTOSH INFECTIONS SOFTWARE REPORTING LOCATION DATE VIRAL INFECTION a. FreeHand Various Mar 88 MacMag Peace b. QLTECH MegaROM Various Oct 88 nVIR c. MS Word 4 Various Oct 88 nVir d. STELLA 2.0 EARN Oct 88 nVIR e. CMS HardDrive Various Nov 88 Scores Utilities, Version 3.4 f. NoteWriter Colgate College Sep 89 Scores and nVIR g. Brady Hypercard Various Sep 89 nVIR-A 1.2.2 (included in the book "Applied HyperTalk") h. Grammitik Various Jan 90 WDEF A i. MacPublishing David Ferbrache Jan 90 WDEF Font Disk j. Chessmate 2100/ Various Apr 90 WDEF Cribgin k. CC-on-Diskette Mike Tyo Apr 90 WDEF A Institute for Scientific Information l. Diskworld Diskette Chuck Hoffman May 90 WDEF Softdisk Publishing 5 STEWS-IM-M (380-19a) November/December 1994 SUBJECT: Viral Infections in Commercial/Government Media/Software m. Excel Microsoft Gail Lawley Jun 90 WDEF Courseware n. SecureWare INC Marshall Abrams Aug 90 nVIR CMW+ o. Rodime PLUS/RX Paul Woodman Feb 91 WDEF A Praxis Software Engineers p. Seiko PS-X Printer DoD-CERT (ASSIST) Jul 92 CDEF Disk Driver Software distributed by American Computer Resources, VA q. Standard Distri- Jim Huggins Oct 93 nVIR bution Disks Michigan Daily University of Michigan Computer Kickoff Sale r. CD-ROM Journal of CIAC May 94 nVIR Vacuum of Science & Technology, Vol 12, 1Q94 * s. CD-ROM Infected in Brian Nickels Sep 94 WDEF UK MACFORMAT Adelaide, South Magazine Australia * t. Macintosh System NASA Automated Systems Oct 94 MDBF 7.5 Sample Upgrade Incident Response Kit (HDSC Setup Capability and Disk First Aid Applications Infected at NASA Locations) 5. ATARI INFECTIONS SOFTWARE REPORTING LOCATION DATE VIRAL INFECTION WordUp 2.0 Various Sep 89 Key 6. AMIGA INFECTIONS SOFTWARE REPORTING LOCATION DATE VIRAL INFECTION Sama Software Inc Leonard Fetterhoff 1988 Byte Bandit (Infected disk distributed in "AmigoTimes") 7. Individuals may forward any information on additional incidents to cmcdonal@wsmr-emh34.army.mil. 6