sarrel@tut.cis.ohio-state.edu (Marc Sarrel) (12/05/88)
Well, here we go again, folks... I think I may have found a new virus. Interferon 3.1 did not detect it, but some strange (if benign) things have been going on. I first suspected a problem when three of my floppy disks (which I hadn't look at in a month or two) suddenly had new disk icons. The new icons resembled a "Hello, my name is ____" sticker. I tried to reformat them, but it didn't help. Then, I decided to poke around a newly formatted disk with resedit. The only file that it showed on the disk was the desktop file. However, resedit wouldn't let me open the file. It gave me error -49. IM says that this is "The read/write permission of only one access path to a file can allow writing", but I'm not sure exactly what this means. But it gets better. If I do a Get Info on the dektop file (from within resedit) it says that the Creator of the file is ERIK. Does this name sound familiar? However, note the spelling. I believe that the SCORES related resources was ERIC. Anyway, there is one more piece of information. If I try to do another erase disk, on one that already has the new icon, when it asks if I want to erease the disk named XXX, it adds the words "facade by Greg Marriot" to the name of the disk in the dialog box (but not on the desktop). Does anyone have an explanation for these occurences? Is it really a virus, or can the symptoms be explained in other ways. I used virus detective to check my hard disk, and the only file that seemed to be infected with ERIK was the desktop. Of course, it could be hiding under a psuedonym. Please don't accuse me of being alarmist. The last thing I want to do is start a flame war like we had not too long ago about the nVIR virus. --marc
rang@cpsin3.cps.msu.edu (Anton Rang) (12/05/88)
I decided to respond to the net to quell any fears about this.... Marc Sarrel writes: >I think I may have found a new virus. Interferon 3.1 did not detect >it, but some strange (if benign) things have been going on. I first >suspected a problem when three of my floppy disks (which I hadn't look >at in a month or two) suddenly had new disk icons. The new icons >resembled a "Hello, my name is ____" sticker. I tried to reformat >them, but it didn't help. The "Facade" INIT allows you to change the icon for a disk. This must be installed on your boot disk, because.... > If I try to do another erase disk, on one that >already has the new icon, when it asks if I want to erease the disk >named XXX, it adds the words "facade by Greg Marriot" to the name of >the disk in the dialog box (but not on the desktop). Also, Marc says: >But it gets better. If I do a Get Info on the dektop file (from >within resedit) it says that the Creator of the file is ERIK. This is correct. I don't know why Apple chose "ERIK" as the creator of the Desktop file; I suspect whoever originally did the Finder was named Erik.... >Does anyone have an explanation for these occurences? Is it really a >virus, or can the symptoms be explained in other ways? Look in your system folder and see if the "Facade" INIT is there. It's also possible, I suppose, that someone might have installed it directly into your system file--you might want to check there, too. Anton Rang rang@cpswh.cps.msu.edu +---------------------------+------------------------+----------------------+ | Anton Rang (grad student) | "VMS Forever!" | "Do worry...be SAD!" | | Michigan State University | rang@cpswh.cps.msu.edu | | +---------------------------+------------------------+----------------------+
rsvp@eleazar.dartmouth.edu (R. Scott V. Paterson) (12/05/88)
In article <SARREL.88Dec4225310@tut.cis.ohio-state.edu> sarrel@tut.cis.ohio-state.edu (Marc Sarrel) writes:
.>Well, here we go again, folks...
.>
.>I think I may have found a new virus. Interferon 3.1 did not detect
.>it, but some strange (if benign) things have been going on. I first
.>suspected a problem when three of my floppy disks (which I hadn't look
.>at in a month or two) suddenly had new disk icons. The new icons
.>resembled a "Hello, my name is ____" sticker.>
.>--marc
This icon is part of the facade init. Do you use that? I think the
default setting with facade was to give this icon to untitled disks,
hence you would not get rid of the icon by reformatting.
Hope this is the answer, I really wouldn't like to see a new virus
floating around, but this doesn't sound like one.
-rsvp
R. Scott V. Paterson
Kiewit Computation Center Systems Operator
Dartmouth
rsvp@eleazar.dartmouth.edu
rsvp@dartcms1.bitneteynon@lindy.Stanford.EDU (Barry Eynon) (12/05/88)
You have Facade installed, right? The "My Name is ___" icon is what Facade uses for disks named "Untitled". Try renaming them. Watch the icon change. Presumably you were using ResEdit under Multifinder. Therefore the Finder had the Desktop file open for read/write, so when ResEdit tried to open the file read/write, it failed. I don't know if there's any way to get ResEdit to open a file in "browse" (read) mode. Try again under singleFinder. And the desktop file has always had a creator of FNDR and a creator of ERIK. -Barry Eynon
sarrel@dulcimer.cis.ohio-state.edu (Marc Sarrel) (12/05/88)
Sorry for any alarm that I caused. Yes, all who replied were correct, I _do_ have the facade INIT installed. I stuck it in the system folder myself a while ago and forgot about it... Also, as some pointed out, the reason that I couldn't use resedit on the desktop file was that I was using multifinder. mea culpa... :-) just a little paranoid in Ohio... :-) -=- Marc Sarrel sarrel@cis.ohio-state.edu | "Language is a virus from Department of Computer and Information Science | outer space. And, it's The Ohio State University | better to hear your name 2036 Neil Ave., Columbus, OH USA 43210-1277 | than see your face."
pv9y@vax5.CIT.CORNELL.EDU (12/06/88)
In article <SARREL.88Dec4225310@tut.cis.ohio-state.edu> sarrel@tut.cis.ohio-state.edu (Marc Sarrel) writes: >Well, here we go again, folks... > >I think I may have found a new virus. Interferon 3.1 did not detect >it, but some strange (if benign) things have been going on. I first >suspected a problem when three of my floppy disks (which I hadn't look >at in a month or two) suddenly had new disk icons. The new icons >resembled a "Hello, my name is ____" sticker. I tried to reformat >them, but it didn't help. Then, I decided to poke around a newly Based on this alone, it sounds as though you are running FACADE, which allows you to set specific icons to come up instead of the generic disk icons. If your disks are called Untitled, they will have that Hello, my name is icon. It also modifies the get info box, as you found. The next question is if you know you are using this INIT or if someone put it on as a joke. Adam