_________    _                ______      _____    _  ____      _
  ____/"""./###/____)\_____________  \   ./ ____/"""./____)\/""./______)\
 /"""/   //_______   /"""/""./"___/_  \ // /""./   //""____/  //_______  \
/   /   //"""/"  / //   /  //____   \_ \/ /  //   //  ____/  //"./""""/ //
\      //   /  ____/   /  //""""/X\@!/   /  //   //  /"""/     //    ___/
 \_____/\__/___/_""\______/_________/   /___/____/\_____/\_____/\___/::.
                /____/
                              Team Denmark
  >>>>>>>>>>>>>>>>>>>>>>>>>>>--------------<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
                               29-03-1995


         DO NOT START THE 'OPUS5' FROM THE ARCHIVE 'OPUS5.LHA'
      -----------------------------------------------------------


 There has been released a archive called 'OPUS5.LHA', and there are a
 dectructiv program in the archive:

 I have not seen the archive yet, but I have talked to some people that
 used this 'thing', and had there data files replaced,

 It does the same things that 'NCOMM32.LHA', 'CED4.LHA' and 'LHA30.LHA'
 it will replace the data's in EVERY file with the text:

 'CIRCLE OF POWER 1995:'

 Please take care,  there is a  lot of fake programs around, that does
 this thing. Checke everything before you start it.

 If you find this program, please send it to me, or send it to all the
 well known antivirus programmers.



 I now know some more about the FAKE Opus v5.0, it has a size of 347308
 bytes.  The archive 'OPUS5.LHA' has a size of 464397 bytes, and in the
 FILE_ID.DIZ you can read:

 -------------------------------------------
            DIRECTORYOPUS v5.0
 -------------------------------------------
 * Uses multiple processes for windows.
 * Full REXX support
 * Faster dir-routines.
 * Better archive handeling, supports LZX!
 -------------------------------------------

 No anti-virus program can find this trojan yet, but I have tested it on
 all the wellknown killers,  and there are only 2 that detects something
 yet, but this trojan  is now on it's  way to every wellknown anti-virus
 programmer

 VirusWorkShop v4.9, can not find it yet,  but will give you a requester
 saying that:
 "$3f0/$3f1/$3e8 Hunk at the beginning found"

 VT v2.71 can not find it yet, but will give you a requester saying that:
 "3E8-Hunk am anfang ist im file"

 Thanx to Kim B. for uploading this 'thing' to our BBS.



 Regards....
                                       _________    _
 Jan Andersen.                    ____/"""./###/____)\_____________
 Virus Help - Team Denmark.      /"""/   //_______   /"""/""./"___/_HELP!
                                /   /   //"""/"  / //   /  //____   \_
                                \      //   /  ____/   /  //""""/X\@!/
                                 \_____/\__/___/ ""\______/_________/
                                              /____/

[Go back]