Virus Hoax: Sheep.exe

SHEEP.EXE is a program which creates a cute animation of a little sheep which wonders around the screen, eats, sleeps, jumps etc. There were several widespread warnings that this program was a trojan or a virus, but after SHEEP.EXE and SCMPOO16.EXE samples were analysed, the program was found innocent. However, during the analysis the original Japanese author of this program was contacted, and it was found out that SHEEP.EXE is a commercial program, and should not be passed on between users.

This kind of hoax is different from the traditional e-mail chain letter hoaxes, such as Good Times, since several innocent programs have received lots of publicity lately as they have been accused of being trojans or viruses.

Naturally, whenever any program is declared clean, there's a risk that somebody will take the file and infect it - since people will now trust it. To overcome this problem, you can verify the files against the 32-bit CRC's of the confirmed clean versions.

The confirmed-clean versions of this program have the following CRCs as displayed by PKUNZIP:

 Length  Method   Size  Ratio   Date    Time    CRC-32  Attr  Name 
  ------  ------   ----- -----   ----    ----   -------- ----  ---- 
  317088  DeflatN 116749  64%  03-12-96  22:17  3662678a --w-  SCMPOO16.EXE 
  317792  DeflatN 117014  64%  09-12-96  08:25  683ae9da --w-  SHEEP.EXE 
  ------          ------  ---                                  ------- 

CIAC has released an advisory on this hoax. Please see also ciac.llnl.gov/ciac/CIACHoaxes.html, and this essay on our site by Sarah Gordon.

[Analysis: Mikko Hypponen, Data Fellows Ltd's F-PROT Pro Support]