[comp.sys.mac] UPTIME VIRUS

angst%csilvax@hub.ucsb.edu (vaguely human) (08/14/88)

A friend of mine received a disk in the mail from a company called "UPTIME."
It was billed as "public domain" software which was being given out for free,
due to something or other about MacWorld.  Well, he doesn't even subscribe to
MacWorld, but they got his address somehow or other.

Well, he was fool enough to load the disk and try some of the programs.
Apparently, there's a lame football program on the disk and some sort of
"money" program as he calls it (in addition to others).  He ran the "money"
program and it said something like "rearranging system folder; this may
take a while."  Sensing destruction, my friend tried to restart his Mac II,
but the disk would not come out.  Of course it would not boot off of this
nasty disk, so after a few failed attempts, he used a paper clip to eject
the sickly disk.

He booted from a System floppy, and then reinstalled his system folder, 
thinking all was well.  Well, a short time later, his Mac just turned off
while he was typing, just as if he had selected "Shut down" from the "I
can't remember which" menu.  He looked in his system folder, and, surprise,
all of the icons had an "A" written across them.

Has anyone else seen this virus?  Has anyone found a cure?

And no, it's not for me, it's for my friend.  No, really...

but you...without clothes		 |           Dave Stein
oh, i could not keep a straight face	 |   angst%csilvax@hub.ucsb.edu
me -- without clothes?			 |  angst%csilvax@ucsbuxa.bitnet
well a nation turns its back and gags... | ...ucbvax!ucsbcsl!csilvax!angst

jlc@atux01.UUCP (J. Collymore) (08/27/88)

In article <767@hub.ucsb.edu>, angst%csilvax@hub.ucsb.edu (vaguely human) writes:
> A friend of mine received a disk in the mail from a company called "UPTIME."
> It was billed as "public domain" software which was being given out for free,
> due to something or other about MacWorld.  Well, he doesn't even subscribe to
> MacWorld, but they got his address somehow or other.
> 
> Well, he was fool enough to load the disk and try some of the programs.
> Apparently, there's a lame football program on the disk and some sort of
> "money" program as he calls it (in addition to others).  He ran the "money"
> program and it said something like "rearranging system folder; this may
> take a while."  Sensing destruction, my friend tried to restart his Mac II,
> but the disk would not come out.  Of course it would not boot off of this
> nasty disk, so after a few failed attempts, he used a paper clip to eject
> the sickly disk.
> 
> He booted from a System floppy, and then reinstalled his system folder, 
> thinking all was well.  Well, a short time later, his Mac just turned off
> while he was typing, just as if he had selected "Shut down" from the "I
> can't remember which" menu.  He looked in his system folder, and, surprise,
> all of the icons had an "A" written across them.
> 
> Has anyone else seen this virus?  Has anyone found a cure?
> 
> And no, it's not for me, it's for my friend.  No, really...
> 
> but you...without clothes		 |           Dave Stein

I recently received (I guess) the same disk.  I tested things out on the floppy
first.  Things seemed OK, so I dragged over MenuClock 3.0 to my system folder,
Klondike, and Money Matters to my other folders on my hard disk. 
(Note:  I have a dual floppy SE, with an external Peripheral Land PL30
Turbo hard drive).  So far, nothing weird has happened.


						Jim Collymore

ins_ammm@jhunix.HCF.JHU.EDU (Mamdouh Maher) (08/31/88)

In article <767@hub.ucsb.edu>, angst%csilvax@hub.ucsb.edu (vaguely human) writes:
 > A friend of mine received a disk in the mail from a company called "UPTIME."
 >[...]
 > Well, he was fool enough to load the disk and try some of the programs.
 >[...]
 > program and it said something like "rearranging system folder; this may
 > take a while."  Sensing destruction, my friend tried to restart his Mac II,
 > but the disk would not come out.  Of course it would not boot off of this
 > nasty disk, so after a few failed attempts, he used a paper clip to eject
 > the sickly disk.
 > He booted from a System floppy, and then reinstalled his system folder, 
 > thinking all was well.  Well, a short time later, his Mac just turned off
 > while he was typing, just as if he had selected "Shut down" from the "I
 > can't remember which" menu.  He looked in his system folder, and, surprise,
 > all of the icons had an "A" written across them.
 > Has anyone else seen this virus?  Has anyone found a cure?
 > And no, it's not for me, it's for my friend.  No, really...

  I do not think that this is a virus. I think that your griend destroyed
his own system disk by restarting his Mac II in the middle of a writing
operation. UpTime may not be the best value for the money, but it is
reputable enough not to try any virus trick. The rearranging of the
system folder may have been a system task, rather than a task initiat d
by your program.

                                                     Mamdouh Maher

phssra@emory.uucp (Scott R. Anderson) (09/12/88)

In article <767@hub.ucsb.edu> angst%csilvax@hub.ucsb.edu (vaguely human) writes:
>A friend of mine received a disk in the mail from a company called "UPTIME."
>It was billed as "public domain" software which was being given out for free,
>
>Apparently, there's... some sort of
>"money" program as he calls it (in addition to others).  He ran the "money"
>program and it said something like "rearranging system folder; this may
>take a while."  Sensing destruction, my friend tried to restart his Mac II,
>but the disk would not come out....
>
>He booted from a System floppy, and then reinstalled his system folder, 
>thinking all was well.  Well, a short time later, his Mac just turned off
>while he was typing, just as if he had selected "Shut down".

Interesting that you should mention this.  I borrowed the very same disk from
someone here who also received it in the mail, and I also had some problem with
the Money Matters program.  It started up OK, and was basically for calculating
loan payments, etc. based on input data.  Not being interested, I then
attempted to throw it away, but every time I selected it, my Mac II would
freeze up.  I finally removed everything else from the folder and threw the
folder away.  Weird!  I haven't had any subsequent problems, however.

>He looked in his system folder, and, surprise,
>all of the icons had an "A" written across them.

I don't have any "A"'s written across my system files, but the Uptime disk does
come with a different system file icon (the upper part of the Mac has a double
outline around it), and I found that that one had replaced the original system
file icon.  I have seen this sort of icon-swapping happen before (although I am
ignorant of how it works), so I don't think it is anything to worry about.

>Has anyone else seen this virus?  Has anyone found a cure?

There is no evidence that it's a virus, and I doubt that it's even a trojan
horse; it's probably just a program that doesn't work very well with the Mac II
and/or System 5, like so many others.  Needless to say, it doesn't leave a very
good impression about Uptime, which is actually trying to sell these programs
on a subscription basis (this disk was the "Best of Uptime" :-).

*
  *      **                  Scott Robert Anderson      gatech!emoryu1!phssra
   *   *    *    **          phssra@unix.cc.emory.edu   phssra@emoryu1.bitnet
    * *      * *    * **
     *        *      *  * * * * * * * * * * * * * * * * * * * * * * * * * * * *

ogus@crystal.berkeley.edu (Arthur E. Ogus) (09/13/88)

I had a similar experience with the Money Matters program on the
Uptime Disk. (I never saw the A written on folders, but my Mac 
would freeze if I tried to click on the icon.)
 A local mac guru showed me what was wrong--the problem is
that its icon has no mask.  Resedit has a default mask making feature
which can be used to fix it.  There may of course be other things
wrong with other copies, but mine seems to work fine now.