Anti-virus software developer Sophos reports the detection of the latest Trojan, Trojan.Futs, that is designed to integrate with Novell Netware. When executed, the Trojan presents the user with a screen containing various options. These include filling the local hard disk, erasing the CMOS memory, deleting all files on the local hard disk, causing the NetWare server to beep constantly, making various NetWare queries or activating a multi-user chat system.
The Trojan includes a "boss screen" option, which pops up a fake Borland Pascal 7.0 window. Troj.Futs also has an option to drop the BW-770-b* DOS executable file virus. *BW-770-b is a DOS executable file virus that when executed, infects COM and EXE files in the current directory, increasing their length by 770 bytes.
Occasionally the virus displays the message: "Don't be a fool, fuck the school", attempts to format the hard drive, or causes the computer to beep constantly until it is rebooted.
The virus was written with the Biological Warfare virus construction kit.
Depending on the settings of your F-Secure security product, it will either automatically delete, quarantine or rename the suspect file, or ask you for a desired action.
More scanning & removal options
More information on the scanning and removal options available in your F-Secure product can be found in the Help Center.
You may also refer to the Knowledge Base on the F-Secure Community site for more information.
Technical Details: Kaspersky Labs; May 2001