jap2_ss@uhura.cc.rochester.edu (Joseph Poutre) (10/01/89)
We appear to have found a new virus, or at least a new strain of a virus here at the University. It attacks Macwirte and the System. What it does is alter ICN128 of Macwrite to have the word Macwite or perhaps Macwight instead of the lines. While in the system it causes problems with the Chooser, preventing it from finding any printing resources or Appletalk networks. It appears to have a counter within the system, which increases every few times the System is accesses, evne by something as innocuous as Get Info. Eventually the disk crashes, after causing boot problems, problems with copying applications and documents between disks, and eventually requiring possible reinitializing of the disk. I am not certain these are all symptoms, or if they are all the symptoms. The only clues I have been able to find are an added STR 108 in Macwrite, and the inability of Resedit to find about 2/3 rds of the System's resources. We continue our work, and hope that something is know about this. If it is a new virus, be warned. No anti-virus program we have can identify it, including the latest versions of Vaccine, Anti-pan, Virex, Virus Rx, Interferon, and even Disinfectant 1.2. It appears unable to write to a physically locked disk. Whether software locking works is unknown at this time. I have also posted to comp.virus, but my message has not appeared yet. Please send me any programs you feel might help me root out this virus. We have Resedit, Fedit, all the above anti-virus software. I would like a file comparison program, is one is available free or as shareware. Thank you for your time and effort. I will post further information as I get it. The Mad Mathematician jap2_ss@uhura.cc.rochester.edu Understand the power of a single action. (R.E.M.)