COP IconDepth v1.30 Trojan - Amiga Virus Encyclopedia

VIRUS HELP TEAM



  --------------------------
  Amiga Virus Encyclopedia    
  COP IconDepth v1.30 Trojan
  --------------------------


  Icon Trojan:

  other possible names: IconDepth (1.3) trojan

  Filelength: 2384 bytes (packed with PowerPacker 4.x)
              4188 bytes unpacked

  Based on a third party information, the programm is in large parts
  comparable to the NComm32 trojan from the COP guys.

  This is supposed to be a tool to decrease the planenumbers in Icons.
  This routine is buggy and or done by full knowledge of the destructive
  workings. Some bytes in a lot of files will be changed and cannot be
  repaired !

  The code looks like a partly optimized assembler code, but code be done
  by a ordinary C compiler, too.

  File ID Diz from the archiv:
  ----------------------------

  IconDepth V1.3! If you are using
  MagicWB then this is what you need!
  50% faster when using WB!


  The following directories will be affected from the trojan:

  'sys:prefs/'
  'sys:devs/'
  'sys:l/'
  'sys:c/'
  'sys:libs/'

  In this directories there are only a very few icons, so it looks even
  more suspicious.

  The trojan prints the following text to keep the user friendly:

  'Hold on while IconDepth V1.3 is converting your icons!'


  Removal: Kickstart 1.2 & 1.3 : VT-Schutz v3.17
           Kickstart all others: VirusZ III, and also Xvs.library must be installed


  Test by Markus Schmall                    Detection tested 27.04.1995.


  


Virum Help Team
Denmark & Canada
Copyright © All rights reserved
www.vht.dk