[comp.sys.atari.st] VIRUS PREVENTION AND HELP FOR SPECTRE OWNERS

Z4648252@SFAUSTIN.BITNET (Z4648252) (12/13/89)

Hello all,

    Start the New Year out right, protect your Spectre software from
virus infection.  Yep, just like a real Mac, your ST can become infected
with real Mac virus critters.  As a side note, the ST has unique ability
to become infected with ST, IBM, and Mac virus varmits, all due to the
wonders of emulation.
    The following are available now from LISTSERV@RICE and the syntax
is for BitNet.  You'll need help for FTP syntax and other net syntax
which I know absolutely nothing.

    The following file names have a brief description.  Syntax follows
afterwards:

virus-detective-31a         -- Accessory.  User configurable resource string
                                           search.
disinfectant-14             -- Application.  THE BEST.  Searches for
                                             virus and kills it.
gatekeeper-111              -- INIT/CDEV.  Complex but is the best virus
                                           preventive.

    Keep Gatekeeper active during all sessions.  Check your disks and
partitions religiously with Disinfectant.  When a new virus arrives and
is announced on the nets, take the string information given and install
it on Virus Detective.  Check your disks then with Virus Detective.
    Disinfectant will normally be updated a few days later and sent to
the nets.  Terrible cycle, isn't it?  Now, aren't you glad that our OS
is in ROM?  Though we have our share of virus events, they are nothing
like they are in the other computer worlds.
    Virus Detective and Disinfectant are only a few days old at this
writing, that is, are the latest versions and have December dates.  GateKeeper
has a September date and is due to be updated shortly.  It is, however, the
BEST 'gatekeeper' in screening what is going on in your Spectre.  It will
prevent the virus from entering.  Disinfectant and Virus Detective can
only detect with Disinfectant being the only one able to clean things up.
Virus Detective can only clean out a new virus called WDEV.  Clear as mud?
Don't worry, just use these three and you'll be in great shape.
    Syntax listing:

$MACHARC GET virus/gatekeeper-111.hqx
$MACARCH GET virus/disinfectant-14.hqx
$MACARCH GET virus/virus-detective-31a.hqx

    All three available at LISTSERV@RICE.
    Special flash!!!!
    This is non-virus related....  Do you like and use the UIS II or other
GEM file selector box programs?  Do you wish the same can be had for your
Spectre?  Well, the following program can fulfill your wishes and MORE.
This is the latest and was just released to the nets:

$MACARCH GET cdev/boomerang-20b9.hqx

    This is a fantastic program and just like UIS II/III, something that
should have been burned in the OS ROMs.
    They keep coming in.  Here is another "required" program for your
ST Spectre.  Just released...  It is a replacement for the previous
version.  LAYOUT 1.9 will customize the fonts and placement for your
desktop.

$MACARCH GET util/layout-19.hqx

    These five programs would be a perfect stocking stuffer for
the new Spectre GCR gift.  Most have December release dates and will
offer the ultimate virus protection and will give more versatility
to your ST investment when running Spectre GCR.

Larry Rymal:  |East Texas Atari 68NNNers| <Z4648252@SFAUSTIN.BITNET>

mjv@iris.brown.edu (Marshall Vale) (12/15/89)

In article <891213.09444156.032840@SFA.CP6> Z4648252@SFAUSTIN.BITNET 
(Z4648252) writes:
> Start the New Year out right, protect your Spectre software from
> virus infection.  Yep, just like a real Mac, your ST can become infected
> with real Mac virus critters.  As a side note, the ST has unique ability
> to become infected with ST, IBM, and Mac virus varmits, all due to the
> wonders of emulation.

 There is a new virus out infecting Macs these days called the WDEF virus.
Some of its effects are crashing after choosing Save from some programs
(such as Word...), crashing MacIIci's and Portables (will it crash a
Spectred ST? I don't know), and slowing down AppleShare servers.  The
WDEF virus hides itself in the invisible DESKTOP file that is on every
Mac disk.  As soon as you put in an infected disk into your system, your
DESKTOP file will be infected.  It spreads very fast.  You should check
every disk you have (that includes HD partitions), since it can have
horrible results but is easy to get rid of. If you are uneasy about using
ResEdit (you can do horrible things to your system with it) then do try
one of the other suggested cures.

Here are 3 ways of finding it and killing it.

 Virus Detective 3.1:  Add the following line to the list of checks:
  Creator=ERIK & Resource WDEF & Any
 Select the single file search and choose the DESKTOP file from the root
level of your disk.  If it does match then select remove.  Under 
multifinder, I recieved an error but it did erase the fake virus.  If
you want to be safe, be in single finder mode and check for the virus
while running any application, since you won't have the Desktop file
open when you make changes.

  ResEdit:  Launch the program and open the DESKTOP file.  Scroll down
the resource to see if there is one called WDEF.  Open the WDEF resource.
If it comes up with an ID=0 (that's zero) then you have the real virus.
To kill the virus, just select the WDEF resource and select CLEAR from
the edit menu. Save the changes.

  "I Don't Have Those Programs":  You can get rid of the virus by 
rebuilding the Desktop.  When you insert a disk (or mount a HD partition)
if you hold down the Alt-Cntrl keys (Option-Command on the Mac) you will
get a dialog box asking if you want to rebuild the desktop.  Click on
OK.  The disk will be busy for awhile.  If you had a virus on the disk,
it won't tell you, butthe WDEF will be killed.  Do take note that rebuilding
the desktop gets rid of all the text that is in the Get Info boxes.

 We have just found the virus in the public Mac clusters here at Brown U.,
so this virus is for real.

-- mjv@iris.brown.edu

"And, oh! Father Christmas, if you love me at all,
 Bring me a big, red india-rubber ball."
                                   A.A. Milne "Now We are Six"

psurge@cs.utexas.edu (Troy Carpenter) (12/16/89)

We here at UT have known about this virus now for about a week.  The two ways
mentioned before (via virus detective and Res edit) both work, but get 
disinfectant 1.4, which should be available now (we've had our copies for 5  
days now.)  It will automatically kill WDEF, as well as all the other MAC
viruses.

So far, I have not seen any ST's infected.  I checked all my disks and my
hard drive with Disinfectant 1.4, and none have had it.  Disinfectant 1.4 also
has a nice history and description of what it does.

WDEF still comes back, but we have pretty much licked it here.  When we first
found out about it, we found it on all our servers, but like I said, with 
Disinfectant 1.4, it it almost gone (but seems to want to keep coming back,     
also!) 

This virus is not just in the US, it was discovered in Belgium, so all you 
European Aladian users (as well as Spectre) should check for it too.
                              Troy Carpenter
                            Computer  Sciences
                      THE University of Texas, Austin
			   psurge@cs.utexas.edu