-----------------------------
Amiga Virus Encyclopedia
COP DirectoryOpus v5.0 Trojan
Other name: Circle Of Power 8
-----------------------------
There has been released a archive called 'OPUS5.LHA', and there are a
dectructiv program in the archive:
I have not seen the archive yet, but I have talked to some people that
used this 'thing', and had there data files replaced,
It does the same things that 'NCOMM32.LHA', 'CED4.LHA' and 'LHA30.LHA'
it will replace the data's in EVERY file with the text:
'CIRCLE OF POWER 1995:'
Please take care, there is a lot of fake programs around, that does
this thing. Checke everything before you start it.
If you find this program, please send it to me, or send it to all the
well known antivirus programmers.
I now know some more about the FAKE Opus v5.0, it has a size of 347308
bytes. The archive 'OPUS5.LHA' has a size of 464397 bytes, and in the
FILE_ID.DIZ you can read:
-------------------------------------------
DIRECTORYOPUS v5.0
-------------------------------------------
* Uses multiple processes for windows.
* Full REXX support
* Faster dir-routines.
* Better archive handeling, supports LZX!
-------------------------------------------
No anti-virus program can find this trojan yet, but I have tested it on
all the wellknown killers, and there are only 2 that detects something
yet, but this trojan is now on it's way to every wellknown anti-virus
programmer
VirusWorkShop v4.9, can not find it yet, but will give you a requester
saying that:
"$3f0/$3f1/$3e8 Hunk at the beginning found"
VT v2.71 can not find it yet, but will give you a requester saying that:
"3E8-Hunk am anfang ist im file"
Removal: Kickstart 1.2 & 1.3 : VT-Schutz v3.17
Kickstart all others: VirusZ III, and also Xvs.library must be installed
Thanx to Kim B. for uploading this 'thing' to our BBS.
Regards....
_________ _
Jan Andersen. ____/"""./###/____)\_____________
Virus Help - Team Denmark. /"""/ //_______ /"""/""./"___/_HELP!
/ / //"""/" / // / //____ \_
\ // / ____/ / //""""/X\@!/
\_____/\__/___/ ""\______/_________/
/____/