HARE virus alert (NOT a joke/hoax)

• Date: Wed, 21 Aug 1996 16:48:55 PDT
• From:
  bloom@dsd.camb.inmet.com (Ray Bloom)

Friends,

This afternoon, at work, we received the following fax from the FBI
regarding an imminent computer virus attack (my edits in brackets).
This is clearly NOT a joke.

= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =

[From:]	FBI Boston Division
	Special Agent James Blackburn
	DECA Coordinator
	One Center Plaza, Suite 600
	Boston, MA  02108

	Voice	617-223-6225
	Fax	617-223-6327

To: [Corporate Security Director]

Message:

	This edition of DECA-FAX is an alert to corporate security
directors and others in charge of computer information systems of a
potentially damaging computer virus known as the "HARE" virus.
Information about this virus is available on the Internet.  Its
appearance is scheduled for Thursday, August 22, and again on
September 22, 1996, and will display the message "HDEuthanasia" on the
screen.  It is a slow polymorphic, multipartite virus and will damage
information systems by writing over all the hard disks on the system
and destroying the data.

	Several commercial anti-virus software programs have updated
versions of their product which should help protect against the latest
batch viruses to include the "HARE" virus.  Systems are always at risk
for the spread of certain viruses and it is believe that the "HARE"
virus entered the U.S. via the Internet.  This information is provided
for those who may need a heightened awareness of potential damage to
information systems from computer viruses.

= = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =

Our computer and network services department here says that this virus
hits PCs only (not Macs, not Suns, etc.).  They say that one should
avoid rebooting one's PC tomorrow (and 22 Sep), and get the
appropriate anti-virus software.

Definitions (as best I can):

	DECA -	"Development of Espionage, Counterintelligence and
		Counterterrorism Awareness".

		See http://www.fbi.gov/deca.htm for details.

	HARE -	Yes, like "Hare Krishna".  Aliases include
		"HDEuthanasia" and "Krsna".  This virus allegedly is
		Win95-aware.

		See http://datafellows.cityhall.com/v-descs/hare.htm
		for details.  Apparently, one can get a FREE HARE
		disinfectant utility at
		http://datafellows.cityhall.com/news/hare.htm.  (This
		is *not* an endorsement of Data Fellows products, just
		the result of a web search.)

	polymorphic - From http://www.umcc.umich.edu/~doug/vb.html:
		"A POLYMORPHIC virus is one which produces varied
		(yet fully operational) copies of itself, in the hope
		that virus scanners ... will not be able to detect
		all instances of the virus."

	multipartite - From the same web page: "... a few viruses are
		able to infect both [files and boot-records].  These
		are often called 'MULTI-PARTITE' viruses, though there
		has been criticism of this name; another name is
		'BOOT-AND-FILE' virus."


As used to be said on the TV show "Hill Street Blues" ...

	"Let's be careful out there, people."



							Ray

--                                                                    --
-- Ray Bloom                                     Intermetrics, Inc.   --
-- Senior Software Engineer                      733 Concord Avenue   --
-- (Previous Incarnation: IBM Systems Manager)   Cambridge, MA  02138 --
-- bloom@inmet.com                               (617) 661-1840 x4096 --
--                                                                    --
with Standard_Disclaimer;
use  Standard_Disclaimer;
function Improve_Message(Text: in Clever_Ideas) return Better_Ideas;
--                                                                    --
-- This is an example of software reuse ... 14.4% of this signature   --
-- was "stolen" from eachus@dr_no.mitre.org.  ;-))                    --

• Prev: Guidelines for extensions.c and Server Packages
• Next: The History Of Frobs, Part Zero (was Re: Use for $call_verb)
• Index: MOO-cows
• Thread: MOO-cows