[comp.sys.mac] WDEF "virus" & symptoms of presence

jacobson@uxe.cso.uiuc.edu (12/10/89)

Well I found out I indeed do have the WDEF "virus" in my Desktop file of my
SE at work. And sure enough when I rebuilt the desktop my trouble with the
screen display of fonts (ie outline in Multifinder would not show up) 
completely disapeared. Thus this virus is already present on the U of I 
campus at Champaign Illinois for those interested in where it is spreading.
Anyway that is the cause of my trouble with outline that I posted last
night here. (Still have the dual name for the Laswerwriter appearing so
I don't know where that came from).
 
Russ Jacobson
Illinois Geological Survey

jacobson@uxe.cso.uiuc.edu (12/10/89)

Heres some more info on the WDEF I found today:
 
For those curious about the curent "virus" WDEF here is a macpaint file of the
screen dump from resedit while I was looking at my desktop before I
rebuilt it. It is binhexed version of a stuffed file so you first decode it and
then unstuff it.

(This file must be converted with BinHex 4.0)
:%h"TBh4eFQ8YEfBYGf4PCLjcDA3!8dP8)90*9#%"!!!!&Ed!!!!!Nd96593K!!%
!!"@pFNaKG3%!!!!!!!!!!!))8f0bC@9Z)$!Z-"`!38C%!#CVc!!+!#DQhJ!!!!-
!*Ue5!!*i%!!Q26)!"+IF!#DQhJ2H!2m!*J!"!!!!*Me-8%j84de36P3"!+'QVl+
KTUqd!!!!!!!!3rX!!!!!!!!90`!!M)%!!!!!!!"X$`!##Ka)X+$"J`J6+Pc)X+(
$Ka!M5Ta)XD,&LaJcDYc)XD0(L2L'"Ib3!#mJ1*%!$T3%!!cPJ*)$!!8%CLaJ!*J
b!`#U#H!QJ!Ff4mk`#@m'"J!ar38%dqaR3!IJ!'!BB"-3M+-'J#J&`"6!K*(`T-l
`d$232"i!$"`ie)J6RkCI!A`!*RCSJ%&'8c*!jNb''EJMkAUBBAGFhJ'-MM'$mGF
V@,%rHZ)p'Z!CXm@0ihi)Lf%'$-Pj!6"MJ"R`ckLGBi!q5S!C%fCq64ZJfjPXJ(M
c'#!pG)JCKmDj!!3I,Ka!X(mPIpMDeQCjFqE1Sd1IrVbkG1[8Vf[2RMblGqcJYiI
r,Pjkm[(Sbj0IRjjkF[AYim1I$lflI2EdlimrRlmrr[rJVA3,1[q8S*preUfN66S
!Q"!!JK"ZXj)E$$S)B)69V@4,K3'dJf&r#R,iiB85"Z4'53F%N!!*2!B%a!-2*9P
i))NC"Q4,53+SL)P5!4KK4S`GMLLIJLLUQ)NYC["J`)m02NKMK"-@Q8NQaTKKaT*
!2UPP'aS@Q8mQKPM*!*-1HVJPL!&T)b@BC[L"!CP1cMKMP#NC'5BBM'8T*i* GeMQ
P)@5)!3DFCZjj)C&qaQ-)(Mci!@163Y)h)BGRdJL6,51Pmmm)qaJk*&,D"!3"Jb-
d%1Pk-,NK+UN19"SI6,Imm`mmT$lJkA``K3V!U!#8HZTq5+N+!!a+'6$!$$li`%G
+5K833&J$k-42VkhHbYkP!4'EeV'HJ3%!!md'J!P5d[CUkkrDjHV(X%T&`#d-B-$
K!4[ar#-Z2)BGm`JJ5[RUURUT$J%!21fq#`Bb$-3aC5"66K)')m`!dfqek,U(P#e
$!!*,`B6aJ!Fi$)5am*6$"!1aa1CDQekZ@'M-FEG`K$`b2Z-%FR+rT[k,DV"!Z!b
!Zi6"Li2-Q6!-b"`Q4cbacZKGkSA2lXV3,5C%-jc)$!mVRA,&#B,DmmBr$m"2X[%
b!%Bm4F1$,`ckmYYVcLT[PbSA'VX6%!2p8-ZdH*GqEIHhHBp`lYlFJIS(),5qcE9
j`@E,+Z%"AKc3$`5+%$GjZ6UZ115-$b!X$)pI([N!Q!jEUqMTJUUj[kK29e)$Ri0
``L(2!)*!@&c0ShIV0CU+&L`JN!"!"!)!))")3*!!k#iilp'pVXd3i-!L!JNN%)m
!)6dKS$cFLjF)1a!3`#)"%G8AMhd!fZrH2CF!Q!Sq,"83FF)MjMm352V,VhpMqpU
!$drmjEYHpVDR2qqjiAhA#q$jm%FacM(RGEC!)#''9ca%2!!3bGZD!j[M2!6b"KR
&`adB#,M"jD6U$r#!4HM@Kbh6DC!!HCPc)HZkPkV90C!!Gbd%h3XA&d-GcY#"0C6
K$EQ@`p2T,eHr)aAhJ"JXk+P3I4[X@rL-@-*F[8q*"8b9reBBaBYGFBHFXq)80mH
m%RRZLb-B)Z3ZKF)RjUq+UT2K%PXA4"qU8A4&"#2UHSM&%TVaFec%SH4N1$JBJQT
G2TaMa3)'!$J%NSJAbjJMpBJZ+`*LNMqN)mmZqFJeHT'6P0bE*6'T5-*T%C4Tp#2
l50Fc6"D5KiC$C5N[9mG1iR'3!$jmC4MMQ-JX0Nk)UXcM'`dj!&hedSqeK+)J5BH
@A*D4Jk##hM(,U%8)f$'BAV3Q&BRC2ff5NBBmmfBURpQh#$McL&icCaqT'5`8*Qk
F,-6P0Q&Cc0A0mP6*K'FA5EFkAHk4PqX%TqF%!%abAU`!K(cQrSU*!)d&P)QHJ`!
3h(M(AedU"+"`ScmV#5SK3-'0pp4CUNi!LRG@P'QALJ!F0+V3A0d1&ZS)b!'mm3m
!l#09"B!"6!0#!'m%T!HA)ZK1!G$6J0LJKc%PUNm"X)-kaY3!"GM(2hiK+hr%9+S
!k%81BcS!!K$8E3Xi9V+@0BDS"!!F$P!+!3B3&@2K`kK)"B!%#U!2!&$e(ri`'!$
'm*N"A%@YIYf@8V#k#kFLaDX!F&X&p-TAT-#!"pNB4ejM%!jMR1%4(kJV!)#+bjK
fJ+jfV5TMBI!$[f,!-$2JPJQ'NB&-!!+V#c8Q9a(V0JY`bf0llHY9KN%BEKeL%+e
pE8#D'Lbd`-1cS,eVAS2Q,Ek@GVHpR8%mMM'!i'*9Uj%%ah%2qe@Pf*DjZA8X"RL
EfU'F!lLZh3GF[4Bqj0C9Z313!"Um`QYDmKj,!QCJEATV@YK`lV5Vh3A!BXIQJqD
D&4`B#)CK"K#1bSB"XjVP,#[EQjDS6V@Ul1M*8@!VaU%5`"`"`B"QLAY'#L[eTe,
dm&+2DVJ8*[8!kUMT1Ha4dj[q%JC**8"5%I"@!8"JXe[PD9)C8&F#b!3#)'"a2BF
9d`-3!!!i')FMSZ`)T@3J$X(`3@9mJBm$F!!132""(*`KN`F8B!,2)!)3GJ8&%Rq
Zb8mZ!J@L8!3#4-(+LKJ"#!5!!K!J!!'L3!3`3+#)&`3N!3@3!%!58#!U4%LiG$K
15CcRA!4b4-$+#JJ"#!#!!Klm@45*!!)2#Lf6"#4!d4#)5J3)S'4Y%$656JD!R1P
-J8X$)!-5#!&DRZ"M3#X##!+)`c2SBQT&4q$(%K#!Qa%+kdR6fYBC%)'Q!B!)!IK
C&)X!K`!+(C8%4%!+5BK!@#J3J%FhG,ZaR[@XV5`%6D02"0G'"""%81L`H&X@58M
"5!i3@iRZ00C8TV+9ma%-%!`!(4`!JCI"c!&KPcN%D#C#@&EYCSak1+B%D)"-!!#
#D3PJeBrfk-@c"``FVEV9*0dZ84R%%T2c`mdUp6$,`B#M(j[EaC+'XT3&IZX*[--
A!$L#$lSXCQ!dr"KJ)!!3*2i!#)6Pakh1kEqGAHFlheS'!!!&!*!!!BSrJd)4)+!
h#J#4&5*))J&8J)4FrQ(MJ3*JkV+QY+@Y,!8!m#)!51KkeX'qlE%A)!T%L%3#F+"
f$#!#ZraNFXl96B'dhRS5`4#!!)l!!`J-B03J))!qaNk!D2!"%SP)Zea&d1TX`6R
ZclDb2L4rF&"XqZYq9J6R!5pi#"3H%IheR1NA6qNj@cRC)J"!h[d-H`M)(K!%Q),
C%`!!Y8Y!")rH2F"h,Q8V6d!F(!Lk$a4HG"mNiKK%E3,6"bB94-4fpd50LJ#HlfE
d%d$pKNHm,4#Cih)%""4j@crTFb8`PEmI!!*JH,RR"KN$G`&h$P9fDh&`$0NA"&q
fF%"`G$ha!"r6G'(aI)rf0DHRERCQCB+!!U)!!--J!SJ!D)*'D'-(!!P3""$!I,F
A@aV)Hh4'$PDA!I+!!S)3!%9!JPNREjJ(#!'`JLeSHk2RCMf$EP6RHlHf#1K!#!+
3!!3FJ!J"!!,b*J,k%!)pXB,`N!!!4"KrID-a'pKl05KlL$!!la"SePD&LK"m3FL
#A1KmqqFeB#L$khCVXUGf38##"%##mkB)**!!K@lBKEKh5JDiF`KSCA*`!Mi!!!i
)"`r!#3bA#,86!!q3!!F4B)'MpfL(if(S!!!+%!""m@2PGhk+4e5GU!!Y!S"F%4$
XCeK%G3imT9i"H(K"pSSpS3!3i((29hU+0he6GSLh"J&(3!!"%!`F!!%"`!%4!!`
%!!G(N!!58dB2AP!!U$')0aD'G0D"Y`B$b-!)!M!#)J!$!b!#-J!#$)!)b)"m88!
&P"!&"B"Xd"GNk5Ch04J&5)!p*5!#%&!!)J!&)%!"SDD180#1lcL+kY+,5HJ%9LB
*``J!5D#2#F!"N!!!"#5J$d&!9&q!!jIJ$G4BK)`%"pKBKaQ`$dd)!)mJ#K$`!++
!$i$J!iXJ$N39"463MLaBI[*AJ#'TK"N!!IFB!!'JMcmC!85&#%33Nqa)Cr$BDLe
6L,qBJ$XjM!afM-Ni!H"!!)M`")"`!*'!!p+B!p8iJ$&)9##f+lSBMaIc0#$*8r"
RITB8DHN(J+dB,(6MP[mhLr)AJlk)!qIJ$&D'C4`3!!`)"mQiM-hiM!$`$$K`$ij
!"&'aLlPb1'NjMpN)EB)`MRa'JZ0BMZHBMN%)"$6jB`*S@**CDG!f$`8(!#p!JJ8
J!&,`MiQ!")!`!)Q!"j63"88!$CNSMe4h!C'!Cp1'$)'@!!3J#F%M"l!CK%4`#CA
3"e"JN!#mP*23TJM6"S)@K!Mk!!)ZL3j!Q!"%3!PH8!50+3)NpJDbJS5S*fI4'3)
L`'H"&J!3)!'CK`M(bCf8!!9&%'+dL"5a-LZRGi"mUB$'#*KI&J!q3*M11)'*ZCM
KU@63iApVQA[2NCC[UAq2aK`H0TBSi(''Ye!0QQ2U&jF$%+(pDBMrQ3&cF!l%b)!
3i'4a`)`(qK-i!!+2!*ifH5N@'T)%!'f!J!,H#))`J!#-!(DE@@T%%!#*8*11L43
G5SGcGf[`J!+8`'HJm'18!(B!f6-$N!!-4#!#4`UDeKLLba'CZqQ8mNN+!F"ePNF
#B%F#FR#4"*!!"(a!!SR3"q&CS@d!Gi`(EBL!#,iJT6rQ#f$RNM$jT[+6$$@jS6#
aT+0CDeDfTdi)JK"`2@"RP89*U#$3T4k*&#+DFrjTCA"`##PkM#cUSPJj!'NQSc6
UK4GcSc`&L`!!",+BT!1`T+EB%c%KLk'TUF[a"c%'!2b!S@9TTkr3Urb`PKcD(1!
`SVpBSJ[iPbSkUK)i!)m3Siq!!KFSRM$a('#!Sp%*JZcjSd%DGXG(U%D+!VFRIm`
"#L(CT"QJ!$MST`"3TAZQ!##!I%Q`TBR3I+2(BJ)!(CTb!01LEVaTC6,!SfFkT31
JTTQADd3&Th+UVlN+TY[!Urm!X1I*U,IQVS)!Vi$UCb)3I)4k!XQJVaKB%L,`+l4
`XGdU#Z`CUB3!GK!J"(pSUIRkJLDl0pbJFe0'$SjhC3`SS#Y+!#hU!rP31p*+"$*
+IR'j!CI$"QZ*A4Z!XKmDKaZ!X`pD%Nal+Q``$J"3N!#j#3!Rbc3TfkQh&J(''(6
0k'A,U)cJG`#,'3i2J!1F`CCJLl2RQD-%#ijEa`JP5)jK9l$Ub)+K"iI%C6PDHjl
X#JAjL(H8B%%L)!%!+!@FCj[3N!!!8(#Z*SZbjhN"6JN*$cPj*&##SJ#j`cPf"l#
F8$"iF-KL)Q#hH@TPq(#5"qF,SJZj#,"jb2HGi*!!!"4`HrePZ$V$"LTVC4(`Nm*
(#,8,!Zr*HIDTJU*AXQ#VZ3((XpBA$YNhM(#JYX"3S'fVS(%lYrY6YA($$9cVY8[
EY%q,Y9),Pe4VY3#BUm"V,F*,C6N`$dkjJ'Ye$PrfL%-,"k8+&2!!`&mEYLU6XV0
'"$UT#%$+DB%'!+,!GqK)9$AVJXlCZZ1,HJKFJ`Z!$0K$R3!J#"#-"&fE!(K3#BP
!")4VXNf,`543Ja+!!YL$"1e*!*2U[`$)RCD`D*JE[@+,`843Jb)!`p5'KJJ!GXB
M`J9`Vj6`K[YkXaGm`$r-EN+-#'KSI(iQRa,FR3PJVZAhZbXFF%2JP2P`$%pf#&m
Q!%@(!(!J`J2`"(K!$`mJF9mEY@)lPN#JSA3V[T(#$ACFPX59YF&VI`F!#NqfDDT
+a`9-$QQK!+rDa(9l`I4V[eB'$dI!!30JM)liCD+fJ!(K#!!3$Nl`,&fX`SGl`$U
*ML`,MU)VD')(K-8V!C%!LJ1XZDCFJkqjXHTCJS+JK[8D!*!!%!#`h!EiZ6m@[-F
XV*!!GML-!K!#8AJpB-B$LB!5%)"#(e!&i9Qi+`c&0FL%eCE,aX2,4qDH%5$-0FV
$"Hc$05LIN!#`c#5)!*!!S)BT@,`38,bX')I&r#mj#mC15FNqF-Rlk`22c-N!i!$
L,-Uj#XMbUhiIm!rpS,jL#hm!B!GBLl1#['N!J*Y(X3GBfl3JKJ!5e42HFK4pN!#
j28brm1#8Fd$'!ZU)N!!BCK%!IMq4![F`VDJ4d8jXc!FF!EejDarBSi''!#3iD)#
VJJ(`TSF+!"S0YYNmCd3!!6YYJe$+RJM`!!,JJa*!2!H3!!JjB05J#3!MEFj#BX"
-$3*2,AZN`'HFm"R)#faAhE9*8!6RF+5FBG12M00-$34PM3+q%!$S)!V%XkGX66a
*h!GF,49)6FV"Lm&iM@G#6*hZA)8[$!K*(!5&,G)NIFi""`3SVG+"H3!!(B%[hE9
2d!2dm!3jd085$3"kM-rPqf5'RG3)25*1qljHlG!&,-KDPh@'RGUVI5[F!0&*(Eq
bVE-jF0*@YJr[`!P"a`&GeR$-'0UQ5J"`qc&Vep"Jl5TL$AJklB&![A@LB$[dCSk
!qi6[+)4VC`mhMFmBl06F,3*i*`S"6),r+,Q!30i4B0irKXfP20C113r2X*j2`!P
r4VX8'3RTD0pDZ#Y!GYfHNYeUpY5#!03(jpFQf*+iqi4&F0me'3(m`,UZHpF3hYd
b,,Vj5J#4MH%DrQ-8KpMbUl-iS0RFRAe)!)N()!*c8*A3MCK`Q`FU6J#FKFKKEAm
pNAmR0p(M+q3'N!"r(h!!r4AEPF)'X$J!M%a85L%!j2EM++[)RPMPbHEKN!!XCIA
EhcmEQ%80CJ3`"j-B$4#JQ%!`F35JhiPGbi`0#J*JJJ0`MX$!!,)(J&%3Ve%!"'S
(!Bjff@'phQ1)!V``!-#*!!9!!I*'!4r)ja$3MS$1CPjZei"(ePBf$mH`RLq!NJP
!!Q"'!S*JD!'JjT6`"C@1C($HiJFF"#[,RL$`!!6Z!j(q-j2qji'qi!4Fk!FX",%
1JN"3e2*'`i`f!+LZkqHGhVlYiNG3STcqPmM!#IK3jN"`jL!dd'XH#Ac`G%bed9S
lPVN)J$CRff%pPQ$JF41!$bc@farbfh#*!(rFY+j+!,(k!0M9kpK0h*+F&X+Qh%r
!C6Jb!-4!",U)!-6miB#RK!B!GL')$!)!#$JL!%4!"JI[aIX0H""JG3d2!U#!G`)
!$c""m98!!IPheIP1braG,0+jCdp!!!J`mN63"#B2J1ZHm%r-e,$1m["fF(mQmbb
BIa!!#"JIjd`0l$`II%KJ2%!2!d)2##PIdM[hl-85"m+3!(e2J!K`!"-%6`63m26
KLl2e,SX3m!p0MVlN[Z"!lLUh3&-!J0kU66KZEf-rS&#HT"bUa&%rN!$hTJ3!G9p
!Yi6hGKmhpJ(iq16hJfp4IQriSZ6hI%p,L-ri+[-HMamTK9rjPF)IQ1mTP*rirh,
jRQmSQKrk'0,jN[mKS(rk@M,kULmRTVrj%*,kX%mLV$rlq[(kT2mNXTrlpe(l[*m
IZ0rkD,,h[lrkIPmS`QmTLfrl#(),ZjrmlC%Fb-rmrr%'bH%2e+mI[e!5a0(paH(
pi2rpiKrqj$rqjPrqk(rqkTrql,rqlYrqm2rqmKrrp$rrpPrrq(rrqTrrr,rrrYr
r!2$r#F!!5!!(S!%XJ!M`!#V!"-J!a4rKR`!!:

-----------------cut here-------------------------------------------

Well thats the file. I did find the WDEF on the floppy I suspected. It was
a floppy that I had used in the U of I Microcomputer Lab (basement of 
the student union) on a Mac II connected to an Apple Scanner. I had been
suspicious of the disk after I found out about the problem. Sure enough it
had the WDEF in the desktop just like my desktop on the harddrive of my
SE. I used ResEdit to remove it from the floppy and Vaccine asked me if
I wanted to add it to my system disk which I of course said no and it was
gone. On my hard drive I rebuilt the desktop to remove it. Any way all
weird font display symptoms are now gone on my SE once the WDEF was
removed.
 
Russ Jacobson
Illinois Geological Survey