Short: ZAKAPIOR TROJAN De-activator Author: iain@hashpipe.freeserve.co.uk (Iain Hammond) Uploader: iain hashpipe freeserve co uk (Iain Hammond) Type: util/virus Version: 1.2 Architecture: m68k-amigaos After down-loading "util/sys/PoolMem.lha" (PoolMem Version 1.45) from AMINET on 14-7-1999 and installing it I found something *VERY* wrong with it. Once started, A Trojan is installed into memory called "zakapior" :-(((. After disassembly I discovered after some *VERY* poor de-cryption it just sits in memory waiting for you to go on-line, Then i repeatedly sends some vulgar e-mail to "president@amiga.com". Although I am no expert, This is all it seems to do, But *DON'T* take my word for this! Any one wanting to read the message that gets sent mail me. DZT now fixes: PoolMem (v1.45 poolmem.lha) FastIPrefs (v40.37 FastIPrefs4037.lha) Usage: DZT FILE FILE = The full path to the unachived file DZT will check that it is one of the infected versions and make the appropriate fix. DZT will either say: File ERROR! : If something went wrong :-( or *WARNING* DZT can't fix this file!!! : Does not recognise file :-( DZT will then atempt to scan the file for the Trojan, This may not be 100% accurate but may be of help! or ZAKAPIOR TROJAN De-activated!!! : If it worked :-) If all went well you will be able to use either program without the Trojan being started. Please note that DZT does no remove it from the file just de-activates it! If you run DZT with no file name it will tell you if the virus is located in memory, although at this time DZT can't remove it! Next check if you have any of the above mentioned files installed and de-activate it. If not try and find which file is starting it and send it to me so i can update DZT!!! Does anyone no what "zakapior" means? I hope this is of some help :-) email:- iain@hashpipe.freeserve.co.uk WWW :- www.hashpipe.freeserve.co.uk