Lha Checker 1.1 BBS trojan horse:

        Filelength: 3836 bytes (not crunched)

        This is supposed to be a LHA checker (for AmiExpress). At the end
        of the file there can be found a BBS trojan, which scans the user
        data and handles with the files "ram:m1.dax" and  "God-fbtr.lha".

        If the SnoopDos Task is found, the virus  will  do  nothing.  All
        important texts are crypted. It seems that no ordinary linker was
        used for this  virus. Probably  someone  resourced  the  original
        LHA Checker and added the  viruscode. The  virus  is  written  in
        assembler(at least I think so).

                                           Detection tested on 06.03.1994.

        Test by Markus Schmall

[Go back]