--------------------------
Amiga Virus Encyclopedia
COP IconDepth v1.30 Trojan
--------------------------
Icon Trojan:
other possible names: IconDepth (1.3) trojan
Filelength: 2384 bytes (packed with PowerPacker 4.x)
4188 bytes unpacked
Based on a third party information, the programm is in large parts
comparable to the NComm32 trojan from the COP guys.
This is supposed to be a tool to decrease the planenumbers in Icons.
This routine is buggy and or done by full knowledge of the destructive
workings. Some bytes in a lot of files will be changed and cannot be
repaired !
The code looks like a partly optimized assembler code, but code be done
by a ordinary C compiler, too.
File ID Diz from the archiv:
----------------------------
IconDepth V1.3! If you are using
MagicWB then this is what you need!
50% faster when using WB!
The following directories will be affected from the trojan:
'sys:prefs/'
'sys:devs/'
'sys:l/'
'sys:c/'
'sys:libs/'
In this directories there are only a very few icons, so it looks even
more suspicious.
The trojan prints the following text to keep the user friendly:
'Hold on while IconDepth V1.3 is converting your icons!'
Removal: Kickstart 1.2 & 1.3 : VT-Schutz v3.17
Kickstart all others: VirusZ III, and also Xvs.library must be installed
Test by Markus Schmall Detection tested 27.04.1995.