wade@sdacs.ucsd.EDU (Wade Blomgren) (12/05/88)
An article which expresses worries about a "NEW VIRUS" and my response to it. Marc Sarrel writes: > Well, here we go again, folks... > I think I may have found a new virus. Interferon 3.1 did not detect > it, but some strange (if benign) things have been going on. You have not found a new virus. > I first suspected a problem when three of my floppy disks (which I hadn't > looked at in a month or two) suddenly had new disk icons. The new icons > resembled a "Hello, my name is ____" sticker. I tried to reformat > them, but it didn't help. Let me guess. The diskettes are named "Untitled", right? The Hello sticker is the default icon given to Untitled disks by Greg Marriott's Facade init, a clever hack used to give new icons to disks. Take a look in your system folder. Facade will be there. You may even recall having obtained it... > Then, I decided to poke around a newly > formatted disk with resedit. The only file that it showed on the disk > was the desktop file. However, resedit wouldn't let me open the file. > It gave me error -49. IM says that this is "The read/write permission > of only one access path to a file can allow writing", but I'm not sure > exactly what this means. Were you running multifinder? If so the Finder has the desktop file open all the time, and you won't be allowed to write to the disk. It is my best guess that you are running multifinder. You will notice other odd behavior from programs like resedit and font d/a mover when multifinder is running. > But it gets better. If I do a Get Info on the dektop file (from > within resedit) it says that the Creator of the file is ERIK. Does > this name sound familiar? However, note the spelling. I believe that > the SCORES related resources was ERIC. Of course this name sounds familiar! Erik is the first name of one of the people who wrote the original Finder. Every desktop file since the beginning of time has had a creator of ERIK!!! > Anyway, there is one more > piece of information. If I try to do another erase disk, on one that > already has the new icon, when it asks if I want to erease the disk > named XXX, it adds the words "facade by Greg Marriot" to the name of > the disk in the dialog box (but not on the desktop). See the above note about the Facade INIT which you are running. It has what some feel is a somewhat obnoxious habit of placing the author's credit in the device type it returns when it is called. > > Does anyone have an explanation for these occurences? Is it really a > virus, or can the symptoms be explained in other ways. I used virus > detective to check my hard disk, and the only file that seemed to be > infected with ERIK was the desktop. Of course, it could be hiding > under a psuedonym. Hopefully I have explained all of the so-called anomalies. There is no virus here, only an example of a little bit of knowledge being a dangerous thing. :-). > > Please don't accuse me of being alarmist. The last thing I want to do > is start a flame war like we had not too long ago about the nVIR > virus. I did my best to avoid accusing you. > > --marc Wade Blomgren UCSD Academic Computing Services wade@sdacs.ucsd.edu