[comp.sys.mac.hypercard] Don't Use Eradicator! 1.0 INIT

jmunkki@kampi.hut.fi (Juri Munkki) (12/10/89)

In article <1976@accuvax.nwu.edu> jln@accuvax.nwu.edu (John Norstad) writes:
>I've already posted this information in another thread, but I wanted to
>also post it as a separate message with its own title to make sure people
>see it.
>
>We have received two reports of serious problems with version 1.0 of
>the Eradicator! INIT that I posted a few days ago.  We recommend that you
>do not use it.
>
>The Eradicator! INIT was written by three programmers in Belgium to detect
>and remove the new WDEF virus.
>
>We recieved source from the programmers in Belgium yesterday, and we are
>working on developing a more reliable version of the INIT.
>
>I apologize for posting what appears to be a buggy INIT - I tested it on
>my Mac II, and it seemed to work perfectly, so I posted it right away.  This
>was probably unwise, although I thought it was important to get it out as
>soon as possible.

Here's another init that has been tested only on a Mac II. I didn't even
have the virus available for testing, but I just pasted a WDEF resource
in my DestTop and wrote an INIT that deals with that. I'd be glad if someone
could try if this program can actually destroy the virus.

In theory:
My init beeps three times, if it finds a WDEF in the desktop. It then tries
to remove it, but makes no effort to see if it succeeded. I think this should
work at least for finding the virus and it will also remove it from any
unlocked disks. Locked disks will not infect your system, but they will
still contain the virus.

Source code is included so that you can improve this init and see that it
doesn't contain a virus of its own.

BTW: I'm posting this to several Mac groups so that more readers are warned.
     Followups go to comp.sys.mac, where this thread originated. I only found
     the thread by accident, since I don't regularly read comp.sys.mac.

_._._._._._._._._._._._._._._._._._._._._._._._._._._._._._._._._._._._._._._._
|     Juri Munkki jmunkki@hut.fi  jmunkki@fingate.bitnet        I Want   Ne   |
|     Helsinki University of Technology Computing Centre        My Own   XT   |
^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^

(This file must be converted with BinHex 4.0)

:$%YTE'aA4%9',R0TG!"6593K8dP8)3#3""4U!*!%p$&6593K!!-!!"4UFNaKG3%
!N!F#!!K,D@aX9d4&4K[h0!!F0m)!'qf+!"[(V!!"!DS!'rFdrrm"!*!*3)$9cJ!
EamS!"1$D!*!((P"56dT,38K-!3#KTdUdSDGKT!!!%`J!N!B+c!#3"#d,!*!)p5)
!!!3)####Ti!3$JT8Ni!J!"C6NP!*36"!NL&14J!3)2"1ZBeqIJ%B`!%8JL9Tf,#
j3U5)%6BF!d+4mN6*NL")Q!`N#-5K6*SfFHTdf"0!M#3qNa)-G8S*VD36%$`!3+(
!e+TAV9,9LKA!Khmr4Z*l!LJ![#Fp3Cd!-H$I1,Er`-'&"`)!+!Ke`5'!!#%8!3K
I"I!0*cMJ!(b'%6[madrJ2hmMrrf,r!p3fmSr*!2+M&NcjmfH3eFf$%qTkG1S8kY
HcEUekpH`BmZH6EZflGZiFq[HcEZhlpr!J`XI6VbimH2)NbXRVKJ!X)!l!i+*6D!
hK!!FScH@6Thh[hhB6dm2#!he"3-"5`J++)!BlM*Z`XF-J'8NJ1S!NML4#!$3!j3
UJF#55bhBNBBFGFaaAbFS"232$!$BiK-%#cB)`)-46PLKJa"+k"#&"$$)BBBIERK
KKaU'D#''(K)%SSJRNZLLL5bQ#'10*DSiBSX)dBKLMMIq1+11-I))`)XV#YNMN6L
k5!'!E!MBNK%&(TJJ#%QiN3BG4GUBT)a,"JRQNIT*p-1CB9%4!#!%M3F!(%T"39"
G&2c!Jd"18%+!!RB+P!Sm"(M3C`"r%L$$S)8kJ5LJK#a+!#Q1'Z1S1BXH)1LGK*B
@%(i1"5!033US&S3qrlK$%$j1k!1!#+N#i%'V,V6U3kY@Y)T)Uk5d+NbVhS$`K3`
Bd)!",&KFNF`rqLJKa"Rq1%%A2li#+b`XQ"L,V,,-1JZ#2Y%'1k`3ELJ!54"Y'!!
0%%'8*J!-%'5V+3J[h2G#%2H*%#m#,haa(a,Rh%N#!#B%J)33a!c6S!S#&i&--G3
3-E!33J!6$$5#-2%0!$b)m)%6GF!V,ld%f!X![[S5`'m-!$LK#`#F@!`!)aTcl$%
"mpClElllRS1bbJ$`!8)!,X1mFFIadJbbb#6R[22+,!3G-p%Ifc`bcLEVR2,+$2c
Xp0"+!+)'"dS%SJB$4!"#4#!mJh!fafAcE%(CDpF4YKS+V,fb!@hAiF+G&riM#b"
M'#$#QbRA!FXKBM!!5$")!#%$!%)!d6M(XL#ZJ3Z3!%X1a1+0)h'%$`"ilNJ`-"c
JZ3`(F2a[`1)J)NiLPBZ"cq,!(#,$!-)!im)!RMX$M1I5(&)'!T)))JB"F8m"""M
Np)E!MMk&5J8!k!982DLU23r!"KQ!Xld%G@dJJII88qM3il0YlSi6hi039(NE4-#
16q)h+$i,hd-S2JhIir$pRH,VLIL)m$dNI)m*hj16q+BR[[U)M`[IQilib2!p0(b
2$Gq$NrLi*$imI)m2hf16q!Ma284mMa(IJm6h+2%p6(b2%pm$aIG)m6e8I)m9hi2
&pjiL2PamMaIIHilih#-qC(b2'Gq$R`5Sm6eXI)mEfjZ!$MF`!Ib*EhB"iCp!#*+
!KZa%-Q!%BbMdN!#&k@&J)`3j3a1#-)6T)D!*B4J$&H33"MJSU$m")@&!q-'4,Qk
aEf'8$&2!3"%0r0%#f&K#%TL!3!9!D8"'F-%B+J)+6M5M$C@mC#EE!!"$aJ3!DQ3
M%J+J!$L1!3PP#!-CbL#(1`UNNXB)"5aPbBPB!Z#--C'!+DC3"#T8)3!*Q%)Ck&!
&1!5""Lk`)*X!B#%!0!Fk"&("&U-MJBU-M!"Y#%-Dh!##EPS2!Saa3LX-S!NX2!)
'Q%-!%S"4$N!%S4hDd%)dJ#%%5$M"#acM'308*J!Fm"-6qE6#Bel!!$X&J"j)D!-
f`#(1$)L"#ipi33Zd)3Ca'N!@jK4#'l4K!h!pCMaJ!-&'QB$1akbc(B#!"L6F*i+
4`U""2MKT5L1"!L!`J)AXD3-3i!3"r28!&KZe`4P-`&1IKN@F"4!'&5)k86PB&+1
2i"N0*+S0Tij6'1D8JKXH8e*r!&8E-'J$*UKDdDZD-k%,EDJJc)Q#,p`cS2p3"d%
pbSrT"-!-)Y8'59h!'*QUY+C+S-3C"-+%SJ,JTd%eJd"mJ!!Q(U!&'16!2r!"!`c
5!!3)#%4M'0!$)2a$(T!!"3!$rN'2bMi%XjS9E@Ir!Brai(@MFJ!""+$KLXQk$`3
03N!,2+Z1VVf"##rJUe`R5J@,UJ-+MlJY&(TJ`G(k)kpl05N`82TA)!6f$4KS,!!
1d#H6EC8ID'9S+c+JKLHm!`!+-)!V#$*Db[*9(P2BUMb8!!3c3-+eH4@$E'P,fY[
QGVGap5e`K8[9iSlcZ-N&!JL@fpc(3,HVIS8%B#Q"AHebpdlHlDY#a8YHmk*A[H`
PE8RK%9r@dYHq(R8('$$`B,kk)m,Z3i!+$k$98TA8(9m0UcGUc)q5mL2(R25(*0V
keMSi3D$k)#Kd8E$FMF,JS``)l"N)B1%Nc!m)A5fa2dk-MVa#BF%[3-%!f&&Jib,
AI5f!!V*!X&9pY&5[,a@YAb-4iaN6'Cp'&LKicc%!$#$"Jc4V!6E))8i!D''erKL
2&N5k8"0!!38hS3B9'1%$#!4"dScJ!9jFDVVTTR5PeS8%GKpX!"J$3FEEe6)B'"#
%D9"K%6!i4+YI$30$P*JI5[LZ'@L4Lf@F!3%pf+Sr''-'8)4AR!*3KcNYKJ&J&2R
)rd!(3G%jXR@fmjhaR'HD'51%8`3hR+eSJ$a!m!%!im1MpV#V#9Vm$hY%H-)B$!!
$'1!'!"4JC'e`J'%4be(&!X!He&BR-+#48NDi$`B@4%%,N!$`$hE!BMZ$"3"BdfR
YJ[[h2J#'"hrC!H!ZIhHrYI8iBd3!!@R8&KiNi#Xq+"(bH,dJ!#m3J$JG)!-3m*8
GNDJY2Vl0MfqM+Yck#2Jk#3i0J`0"#!Rh+$h')iD5dJ-@@lA('D6!ES4kZVT5pJ'
plBe["ZclUcB`J`U%cNk,+lK"")"&b0Y!!E+hXqLh[ANNE%L!'TH@VdphFKXX8@1
!mp8H3!D!2k4aCil0p45T))'[8)#%GqS$&d1B(bP!N!!0b[1-"r3pJ``)+Ni#+2X
42fM"id1[$edX+elLE)!3FY!'IIJ#!+T!!JC*`IP@%%!Ab+dp!E$k##,RQE3H2IF
TqT5)E[pC-UR`f4G@J!4pX%0P"+#$bJEJKKd!34rdE)8qQ#&4jhFA#Gm&2fN6UJp
ST+)4h8G'+T!!)&*p)'2"F4B!&)"JIAd3!`DLP`Bd@Nq-qPZMqqc3A6r!9q$&GST
!IZER#!$B*`8JIZ#e93M9HYK`I[LR$pi!#DfR$I9R$"9S$3E3%`T3If!PHYU`IrT
J$2AR$3Yi*`8`J"T'!3FSJDQJJ+)AJ(HL6Z%(JH3($K3SHYl`J944IqD`JL2MJJ9
)!C+`Jc2BI[-6%!`!#aCN!@p!!4)&63&K%!LK%!'J"[IK#8K3!(S%!"`3!')!!!l
3H&0J3!'K"eV`"%j3"!4K#)VN"!38%**`"8c`"%0!%*kJ(d43(`'K#N2`"#f"4VC
!"%&!"I35%0S`"93J"90!%1C!"&*3"!J8%2#9"8d3L3(K$aKK"%F!(3S3%9S!K`*
K!803LCFB!#*!"%*3"D%S%#k!"91JLG#K!hrN%`I!!@SS'3'"!*U`A4c`,hfc+6k
dLdAKLb-M"m*BKmSi!23JM#Xb'G4$!F*B&`+JM!EJ33H`!8`8!**KM3E!*V[)!!j
#M3KJ"F,)!HIiLeSJM0CBM#2M"F*i4[+)!'@iLa55MHL)3V[)!VjB23MJ"m+)32c
iLiV9MHjaN!!M`iAGL%--L3$eeSf`8!"YX!CKJ!CX%!!b!!!##NYTE'aA4%9',Q-
d!"`h`J!ElBS!'mHX!!%"UJ!Epc6rr`%!N!P!J0A1!"[(bJ!%i0S!N!FH9%9B9%Y
"5%`"!+'R5aHKTf!K!*!'#CB!N!B&m3!!QNB!N!D-Gbp802$K)m'50'cBJ,K#T)L
4&RE5b+Nc"d35*dQS0&$aSX')0'l'X+P$TJ`)(P2+d+N#*`J0&fKm02"BdJc)-JQ
1U*45CXkE1R,'P(&5Tdd#'(Kb")%a%b5G"!Q#M+'6aNiC)fc#R0R4B!bD-()5N!#
K-iH1R#eGHSMJ!X8)b**b3-4`!82%MJ3"%e3j`bB2#a"eq2S&,0L&BDL)SA+FDHG
0'M)'%E*Kk""&LX4jKi4*@)B-L$YSbVJ"BG-0A""Nh[3%SC-16jp!KD)i3GR)#4B
`8YaG[#FaCK8*H,CjBaA%()T`bNaGf0!)#"JJj26m'E5RLm5,%b!*BjS06MUKDh2
9cTf-p`4%HUkKm`E1&,-JYcC)i"4UQ[&H`5C3)@GX@6PFcCI55Lh4B0Pi[N'9PeZ
QJI!6(5#NB3B)B`!PR4X35PH46Gj&@&&kFkcA(Q,C5BJ#$$hdJ!+))VS(RaYRp0"
D$+p4*pX*8e!K"3LhjCE#CG,4!C3EijRBfREGP6&&'RU8XD*kl,NS4h`TK0#$IfC
Y!8-A+m3!T%T$MYFI@@EeS!+,8Eih*BcMQI''(#LNd3--1k6"`j9NRV9PR5ZXN!$
#I,fCL19CDA4KjCMrE9(SCEi&'HCmIFb8!(KPe#DM5M41&jZ6Y$AASfji!FHJC`p
'1'&Y(NBi'SY8M+KB4r5CJ3+PY6(k@`**6*J'K'R-mCFBCC3""`MJ5@F59@hdK"f
X[8f4aaa#"!X(#M(NKU#cd%T,VEAc*B"YY-*ZUeZh8V4K9BfEcKTHFk#''P@$dJe
A(+A4D9TG#-Y#1YpVl%RRdS%040VBBlLk8GCQE,5'ER93K%'(9jBT#&`5"Y1"-!K
`11`9X@q`YT1p3T(B8@m*)TBA&@Md5Z%E*B(!aKY[V2&C'4+4m@XG[%*iajYVE(L
6#pQp$'-#6l""KX)JPc'Hd'FNi%3CGb!0@h8"%Qfde$D@dB-6V9%K4aJYN8''KR1
JJ2@Q4,A"3UY[X1%ef1-Q%-BF4Zh4VAGK3!9%d8Gr2,93,#c9VEaPZ-#'eAflPM3
,+#ce*e4ikrede(jR(6K68"&ZH&3`X$$jfG9e'kR6!liGpYJpPIejjCZb!,T3DDm
0XpYI`a'hSh)3@E+l&"qFN!$$DE`aQQKN9"5DG,iY0RIG$3#aZZ*rPc(I''h!XIN
)R6TdQ`dSc'(lV8P8j&1b`KmV4alaF3c#'5U"%!Cc$[h`kRc!aZ(#(!N!`36-Dcb
"XfpjbC9ah[#APm9-9Hb*%"fZNbmJ*)%X6eM$I$4hZ,eGMAA9ZCc*J1-%!S*!$45
"d2[JN!!9N!!ib'JHJel@'*JG0932+Sh,6I2f&c2rd@&keA2"(4)`JXiCb(ZfNKL
Za2F'mVR"I1L$NIVB"b&8`8"qqi'9')ji[r`pF!i46&"H1[JA%*CPJ-Pb%+AL8KX
'cLm"N8[!U-SJ"bH%)9NDh1!3L48DdVb&M5"``aYaNMaBTA%)3!N#(0`)ab$%i&C
PL%-G0U-qHP9)$KF5)4a)Q)Ba!%piHGbMr,)M%MPXMJLBdj`B%K$$&+b!"D#Fcac
Z!$BGSLH8a#RF+"[RT91Q-J&I'%,ee"5I"$3K#&*B`K6Q3bBAM2+@8b`FrK`)`69
SNB-HA'0F91D'0f5S$Qj`3hc-'-8*aV)0Ri4"#iK`JaF%33BYF!N,@Y!pfme($A-
)5f358KX!LZU1dkc)bm*!K[5pciRFc!lK`(QiGTS5PH)NTcR4k4,kIDf+c-5L"#f
BZ)8*C6jN'-2Q-"FTJ6N'-Qd)!dJXd`#l"DF-b@S$X15`&)"j5b8XqGHiPTF!Ne)
`+M5ih(bq`*-aa&)15$)2(fme+K"m*8N1QK"i91E6PQPSK@Hmk9,@LB)T3#')lNU
2a6Df+aGBK!iRU-KQT-222,MX$@0B3fG848HFC1F,@Jf$9b`k9$R1i9Pd3+P4b`#
fAbNR$"3ab4XQT#(5C18-Ff!KV%EA1iXPj(9PD0M$d(!J18TfBj!!9Cm"CHDQZ%4
N)SRYjNR,mUBbb23ZpN42qI#eZmAd!3)!&%YTE'`J9d4&4LefDA*eFb"*EQPd'mH
X!!%"UJ!Epc6rr`%!N!P!J0A1!"[(bJ!%i0S!N!FH58j*9$q3"!%!SDG3HD'RB$8
!!!-J!*!'!NF!N!6!@!#3#,aa!!!%#!K!J,H!!3i'&"+3!!@)J!mE4L5)d%QGJ!8
F84a)B8ND0Qa!A#&5a%J,1fRNe*N$)SQE0(6Q###Ba%N5+Mpq"+aj-fI1J3$J!3"
$XDK4JU&13FPMG!#)!e#M5T9+S+V9UeJ*60h+YD[AVf$$LKdl&D%f-!jffU3#!*!
!d5$krVPc%SFZd3"%`K#J+1+,45G@rXPl`F#*,VNSSJJjK562&#T53!JjJqS$L#m
YN!$m``H,Am!c!3NYIZ&LXq%!0N"mN!$!)S!c*)'N"%%5$&BJ-`(4J(#cZ388`8*
if`1M)3Jlep$FrE-R3rJdjI)J3)!9`B`3+F)KY(i0#*C`0YS@0ajCFR,PbjRrm92
L5[dC$$pi!&#3!!TCr2Relp0(4PTpUPBSq1@&48XN`336j"N"f'D,aCF!+"r)&i"
K!0#L@JY!U!FA!&U!d"ir'f+3!"iqrH(M))358QJ+'$i`m%U#!"K`KJ%Jk!'!#dj
!Sm3E!""J"Me"i#-!1%2JN`!%3J!#!3C)!!&""U,`S!3!CRL$a$Rri'#B2q!`m3d
(ri!"$891$&K(6Bm&FH!4@r)L!L+%E8P,BL!`%3S+,b#3!)SNK[e$4S!@`3(!#`R
%!)`!)!3kP$epA3C+#5i!SSB"3PcL4&cQA2S21(e*m!%-(a#U4!"R%(#+%@!)-)S
4,b$4Sd@GIQVC&k+55S!T4k3U#TXAc@G%'Qk3!&''(#$%i!)-"!&9N!"##4(%d!%
Fi&!!)34a!)!-DYe%N!!#E3A%&N%(E)$%!ak"*"***U'NdK`qqJ!!!:
_._._._._._._._._._._._._._._._._._._._._._._._._._._._._._._._._._._._._._._._
|     Juri Munkki jmunkki@hut.fi  jmunkki@fingate.bitnet        I Want   Ne   |
|     Helsinki University of Technology Computing Centre        My Own   XT   |
^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^