------------------------
    Amiga Virus Encyclopedia    
    ConMan Dir Virus
    ------------------------


    ConMan Dir Virus:

    Filelength: 4004 bytes (using TurboSqueeze 6.1)
                8456 bytes unpacked



    This virus creates a new process with the name  "Workbench ". It
    writes a new Dir Command and tries to damage several other files
    (L:RAM-Handler,Devs:System-Configuration,C:Loadwb).

    No spreading was possible on  a  normal (not accelerated) A500+.
    On an AMIGA 4000/40 the virus could be started and wrote  a  new
    dircommand. The virus does not work  with activated  caches.  It
    will simply crash.

    VirusWorkshop removes the process NOT. It simply  fills  up  the
    whole process with "RTS". Sorry guys. I have tried to remove the
    task, but after some crashes  (mainly  on  slower  machines),  I
    stopped this project.

    The virus will sometimes display an alert  and  after  you  have
    pressed a  mousebutton, the value $fa0 will be  written  to  the
    interrupt  enable register. All disk/keyboard  actions  will  be
    disabled.


    Alerttext:
    ----------

      THIS IS NOT A SYSTEM ALERT! THIS IS THE NEW CONMAN-TROJAN VIRUS


              ALL DISK ACTIVITIES WILL BE DISABLED!

    GREETINGS TO JOE/DEFJAM BRUCE/DEFJAM  NATAS/DEFJAM ALEX/DEFJAM AND DOC!



    CONTACT ME xxx-xxx-xx-xx USR 14.4 NO STUFF! ONLY VIRUS-PROGRAMMER AREA!


    Antivirus removal: Kickstart 1.2 & 1.3 : VT-Schutz v3.17
                       Kickstart all others: VirusZ III, and also Xvs.library installed


    Test by Markus Schmall                      Detection tested 30.03.1994
                                             Ramdetection tested 31.03.1994