VIRUS HELP TEAM Amiga Antivirus Website www.vht-dk.dk
------------------------
Amiga Virus Encyclopedia
G-Zus Packer Bomb
------------------------
Name : G-Zus Packer
Aliases : NO Aliases
Type : Trojan
Size : 15016 bytes
Incidence : Delete all the files you try to pack
Discovered : 05 november 1993
Way to infect : No Spreading
Rating : Not dangerous. Only the first attemt!
Kickstarts : 1.2
1.3
2.04
Damage : See below
Manifestiation : Pretend to be a packer program
Removal : Delete this trojan
General comments: This trojan is found at BBS with the following
name: "g-zus001.lha" 12.252 bytes. The G-Zus
Trojan pretend to be a packer/unpacker. But...
don't trust it! Actually it delete your original
file, keep the original file name and write a new
file only 30 bytes. In this file you can read:
"This Is Magic!".
If you start the G-Zus-Packer trojan you will get
the following message on the screen:
"G-Zus The Final Compressor/Decompressor. Anything
else is futile...
...you will be assimilated"
Info : This is a trojan, which claims to be a packer with
fantastic packrates. If you start the packer, the
following will happen:
df0:g-zus df0:Copy (Copy=5188 bytes long)
Creating df0:Copy.god (Copy.god=36 bytes long)
Deleting df0:Copy
The new created file with the extension "god" is
always 36 bytes long and contains the following:
"ThisIsMagic!)< 752#%-'48+475UR["
Antivirus : Kickstart 1.2 & 1.3..... : VT-Schutz
Kickstart 2.0 and higher : VirusZ III, with the new Xvs.library installed
Test made by : Markus Schmall
