jmunkki@kampi.hut.fi (Juri Munkki) (12/10/89)
In article <1976@accuvax.nwu.edu> jln@accuvax.nwu.edu (John Norstad) writes: >I've already posted this information in another thread, but I wanted to >also post it as a separate message with its own title to make sure people >see it. > >We have received two reports of serious problems with version 1.0 of >the Eradicator! INIT that I posted a few days ago. We recommend that you >do not use it. > >The Eradicator! INIT was written by three programmers in Belgium to detect >and remove the new WDEF virus. > >We recieved source from the programmers in Belgium yesterday, and we are >working on developing a more reliable version of the INIT. > >I apologize for posting what appears to be a buggy INIT - I tested it on >my Mac II, and it seemed to work perfectly, so I posted it right away. This >was probably unwise, although I thought it was important to get it out as >soon as possible. Here's another init that has been tested only on a Mac II. I didn't even have the virus available for testing, but I just pasted a WDEF resource in my DestTop and wrote an INIT that deals with that. I'd be glad if someone could try if this program can actually destroy the virus. In theory: My init beeps three times, if it finds a WDEF in the desktop. It then tries to remove it, but makes no effort to see if it succeeded. I think this should work at least for finding the virus and it will also remove it from any unlocked disks. Locked disks will not infect your system, but they will still contain the virus. Source code is included so that you can improve this init and see that it doesn't contain a virus of its own. BTW: I'm posting this to several Mac groups so that more readers are warned. Followups go to comp.sys.mac, where this thread originated. I only found the thread by accident, since I don't regularly read comp.sys.mac. _._._._._._._._._._._._._._._._._._._._._._._._._._._._._._._._._._._._._._._._ | Juri Munkki jmunkki@hut.fi jmunkki@fingate.bitnet I Want Ne | | Helsinki University of Technology Computing Centre My Own XT | ^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^ (This file must be converted with BinHex 4.0) :$%YTE'aA4%9',R0TG!"6593K8dP8)3#3""4U!*!%p$&6593K!!-!!"4UFNaKG3% !N!F#!!K,D@aX9d4&4K[h0!!F0m)!'qf+!"[(V!!"!DS!'rFdrrm"!*!*3)$9cJ! EamS!"1$D!*!((P"56dT,38K-!3#KTdUdSDGKT!!!%`J!N!B+c!#3"#d,!*!)p5) !!!3)####Ti!3$JT8Ni!J!"C6NP!*36"!NL&14J!3)2"1ZBeqIJ%B`!%8JL9Tf,# j3U5)%6BF!d+4mN6*NL")Q!`N#-5K6*SfFHTdf"0!M#3qNa)-G8S*VD36%$`!3+( !e+TAV9,9LKA!Khmr4Z*l!LJ![#Fp3Cd!-H$I1,Er`-'&"`)!+!Ke`5'!!#%8!3K I"I!0*cMJ!(b'%6[madrJ2hmMrrf,r!p3fmSr*!2+M&NcjmfH3eFf$%qTkG1S8kY HcEUekpH`BmZH6EZflGZiFq[HcEZhlpr!J`XI6VbimH2)NbXRVKJ!X)!l!i+*6D! hK!!FScH@6Thh[hhB6dm2#!he"3-"5`J++)!BlM*Z`XF-J'8NJ1S!NML4#!$3!j3 UJF#55bhBNBBFGFaaAbFS"232$!$BiK-%#cB)`)-46PLKJa"+k"#&"$$)BBBIERK KKaU'D#''(K)%SSJRNZLLL5bQ#'10*DSiBSX)dBKLMMIq1+11-I))`)XV#YNMN6L k5!'!E!MBNK%&(TJJ#%QiN3BG4GUBT)a,"JRQNIT*p-1CB9%4!#!%M3F!(%T"39" G&2c!Jd"18%+!!RB+P!Sm"(M3C`"r%L$$S)8kJ5LJK#a+!#Q1'Z1S1BXH)1LGK*B @%(i1"5!033US&S3qrlK$%$j1k!1!#+N#i%'V,V6U3kY@Y)T)Uk5d+NbVhS$`K3` Bd)!",&KFNF`rqLJKa"Rq1%%A2li#+b`XQ"L,V,,-1JZ#2Y%'1k`3ELJ!54"Y'!! 0%%'8*J!-%'5V+3J[h2G#%2H*%#m#,haa(a,Rh%N#!#B%J)33a!c6S!S#&i&--G3 3-E!33J!6$$5#-2%0!$b)m)%6GF!V,ld%f!X![[S5`'m-!$LK#`#F@!`!)aTcl$% "mpClElllRS1bbJ$`!8)!,X1mFFIadJbbb#6R[22+,!3G-p%Ifc`bcLEVR2,+$2c Xp0"+!+)'"dS%SJB$4!"#4#!mJh!fafAcE%(CDpF4YKS+V,fb!@hAiF+G&riM#b" M'#$#QbRA!FXKBM!!5$")!#%$!%)!d6M(XL#ZJ3Z3!%X1a1+0)h'%$`"ilNJ`-"c JZ3`(F2a[`1)J)NiLPBZ"cq,!(#,$!-)!im)!RMX$M1I5(&)'!T)))JB"F8m"""M Np)E!MMk&5J8!k!982DLU23r!"KQ!Xld%G@dJJII88qM3il0YlSi6hi039(NE4-# 16q)h+$i,hd-S2JhIir$pRH,VLIL)m$dNI)m*hj16q+BR[[U)M`[IQilib2!p0(b 2$Gq$NrLi*$imI)m2hf16q!Ma284mMa(IJm6h+2%p6(b2%pm$aIG)m6e8I)m9hi2 &pjiL2PamMaIIHilih#-qC(b2'Gq$R`5Sm6eXI)mEfjZ!$MF`!Ib*EhB"iCp!#*+ !KZa%-Q!%BbMdN!#&k@&J)`3j3a1#-)6T)D!*B4J$&H33"MJSU$m")@&!q-'4,Qk aEf'8$&2!3"%0r0%#f&K#%TL!3!9!D8"'F-%B+J)+6M5M$C@mC#EE!!"$aJ3!DQ3 M%J+J!$L1!3PP#!-CbL#(1`UNNXB)"5aPbBPB!Z#--C'!+DC3"#T8)3!*Q%)Ck&! &1!5""Lk`)*X!B#%!0!Fk"&("&U-MJBU-M!"Y#%-Dh!##EPS2!Saa3LX-S!NX2!) 'Q%-!%S"4$N!%S4hDd%)dJ#%%5$M"#acM'308*J!Fm"-6qE6#Bel!!$X&J"j)D!- f`#(1$)L"#ipi33Zd)3Ca'N!@jK4#'l4K!h!pCMaJ!-&'QB$1akbc(B#!"L6F*i+ 4`U""2MKT5L1"!L!`J)AXD3-3i!3"r28!&KZe`4P-`&1IKN@F"4!'&5)k86PB&+1 2i"N0*+S0Tij6'1D8JKXH8e*r!&8E-'J$*UKDdDZD-k%,EDJJc)Q#,p`cS2p3"d% pbSrT"-!-)Y8'59h!'*QUY+C+S-3C"-+%SJ,JTd%eJd"mJ!!Q(U!&'16!2r!"!`c 5!!3)#%4M'0!$)2a$(T!!"3!$rN'2bMi%XjS9E@Ir!Brai(@MFJ!""+$KLXQk$`3 03N!,2+Z1VVf"##rJUe`R5J@,UJ-+MlJY&(TJ`G(k)kpl05N`82TA)!6f$4KS,!! 1d#H6EC8ID'9S+c+JKLHm!`!+-)!V#$*Db[*9(P2BUMb8!!3c3-+eH4@$E'P,fY[ QGVGap5e`K8[9iSlcZ-N&!JL@fpc(3,HVIS8%B#Q"AHebpdlHlDY#a8YHmk*A[H` PE8RK%9r@dYHq(R8('$$`B,kk)m,Z3i!+$k$98TA8(9m0UcGUc)q5mL2(R25(*0V keMSi3D$k)#Kd8E$FMF,JS``)l"N)B1%Nc!m)A5fa2dk-MVa#BF%[3-%!f&&Jib, AI5f!!V*!X&9pY&5[,a@YAb-4iaN6'Cp'&LKicc%!$#$"Jc4V!6E))8i!D''erKL 2&N5k8"0!!38hS3B9'1%$#!4"dScJ!9jFDVVTTR5PeS8%GKpX!"J$3FEEe6)B'"# %D9"K%6!i4+YI$30$P*JI5[LZ'@L4Lf@F!3%pf+Sr''-'8)4AR!*3KcNYKJ&J&2R )rd!(3G%jXR@fmjhaR'HD'51%8`3hR+eSJ$a!m!%!im1MpV#V#9Vm$hY%H-)B$!! $'1!'!"4JC'e`J'%4be(&!X!He&BR-+#48NDi$`B@4%%,N!$`$hE!BMZ$"3"BdfR YJ[[h2J#'"hrC!H!ZIhHrYI8iBd3!!@R8&KiNi#Xq+"(bH,dJ!#m3J$JG)!-3m*8 GNDJY2Vl0MfqM+Yck#2Jk#3i0J`0"#!Rh+$h')iD5dJ-@@lA('D6!ES4kZVT5pJ' plBe["ZclUcB`J`U%cNk,+lK"")"&b0Y!!E+hXqLh[ANNE%L!'TH@VdphFKXX8@1 !mp8H3!D!2k4aCil0p45T))'[8)#%GqS$&d1B(bP!N!!0b[1-"r3pJ``)+Ni#+2X 42fM"id1[$edX+elLE)!3FY!'IIJ#!+T!!JC*`IP@%%!Ab+dp!E$k##,RQE3H2IF TqT5)E[pC-UR`f4G@J!4pX%0P"+#$bJEJKKd!34rdE)8qQ#&4jhFA#Gm&2fN6UJp ST+)4h8G'+T!!)&*p)'2"F4B!&)"JIAd3!`DLP`Bd@Nq-qPZMqqc3A6r!9q$&GST !IZER#!$B*`8JIZ#e93M9HYK`I[LR$pi!#DfR$I9R$"9S$3E3%`T3If!PHYU`IrT J$2AR$3Yi*`8`J"T'!3FSJDQJJ+)AJ(HL6Z%(JH3($K3SHYl`J944IqD`JL2MJJ9 )!C+`Jc2BI[-6%!`!#aCN!@p!!4)&63&K%!LK%!'J"[IK#8K3!(S%!"`3!')!!!l 3H&0J3!'K"eV`"%j3"!4K#)VN"!38%**`"8c`"%0!%*kJ(d43(`'K#N2`"#f"4VC !"%&!"I35%0S`"93J"90!%1C!"&*3"!J8%2#9"8d3L3(K$aKK"%F!(3S3%9S!K`* K!803LCFB!#*!"%*3"D%S%#k!"91JLG#K!hrN%`I!!@SS'3'"!*U`A4c`,hfc+6k dLdAKLb-M"m*BKmSi!23JM#Xb'G4$!F*B&`+JM!EJ33H`!8`8!**KM3E!*V[)!!j #M3KJ"F,)!HIiLeSJM0CBM#2M"F*i4[+)!'@iLa55MHL)3V[)!VjB23MJ"m+)32c iLiV9MHjaN!!M`iAGL%--L3$eeSf`8!"YX!CKJ!CX%!!b!!!##NYTE'aA4%9',Q- d!"`h`J!ElBS!'mHX!!%"UJ!Epc6rr`%!N!P!J0A1!"[(bJ!%i0S!N!FH9%9B9%Y "5%`"!+'R5aHKTf!K!*!'#CB!N!B&m3!!QNB!N!D-Gbp802$K)m'50'cBJ,K#T)L 4&RE5b+Nc"d35*dQS0&$aSX')0'l'X+P$TJ`)(P2+d+N#*`J0&fKm02"BdJc)-JQ 1U*45CXkE1R,'P(&5Tdd#'(Kb")%a%b5G"!Q#M+'6aNiC)fc#R0R4B!bD-()5N!# K-iH1R#eGHSMJ!X8)b**b3-4`!82%MJ3"%e3j`bB2#a"eq2S&,0L&BDL)SA+FDHG 0'M)'%E*Kk""&LX4jKi4*@)B-L$YSbVJ"BG-0A""Nh[3%SC-16jp!KD)i3GR)#4B `8YaG[#FaCK8*H,CjBaA%()T`bNaGf0!)#"JJj26m'E5RLm5,%b!*BjS06MUKDh2 9cTf-p`4%HUkKm`E1&,-JYcC)i"4UQ[&H`5C3)@GX@6PFcCI55Lh4B0Pi[N'9PeZ QJI!6(5#NB3B)B`!PR4X35PH46Gj&@&&kFkcA(Q,C5BJ#$$hdJ!+))VS(RaYRp0" D$+p4*pX*8e!K"3LhjCE#CG,4!C3EijRBfREGP6&&'RU8XD*kl,NS4h`TK0#$IfC Y!8-A+m3!T%T$MYFI@@EeS!+,8Eih*BcMQI''(#LNd3--1k6"`j9NRV9PR5ZXN!$ #I,fCL19CDA4KjCMrE9(SCEi&'HCmIFb8!(KPe#DM5M41&jZ6Y$AASfji!FHJC`p '1'&Y(NBi'SY8M+KB4r5CJ3+PY6(k@`**6*J'K'R-mCFBCC3""`MJ5@F59@hdK"f X[8f4aaa#"!X(#M(NKU#cd%T,VEAc*B"YY-*ZUeZh8V4K9BfEcKTHFk#''P@$dJe A(+A4D9TG#-Y#1YpVl%RRdS%040VBBlLk8GCQE,5'ER93K%'(9jBT#&`5"Y1"-!K `11`9X@q`YT1p3T(B8@m*)TBA&@Md5Z%E*B(!aKY[V2&C'4+4m@XG[%*iajYVE(L 6#pQp$'-#6l""KX)JPc'Hd'FNi%3CGb!0@h8"%Qfde$D@dB-6V9%K4aJYN8''KR1 JJ2@Q4,A"3UY[X1%ef1-Q%-BF4Zh4VAGK3!9%d8Gr2,93,#c9VEaPZ-#'eAflPM3 ,+#ce*e4ikrede(jR(6K68"&ZH&3`X$$jfG9e'kR6!liGpYJpPIejjCZb!,T3DDm 0XpYI`a'hSh)3@E+l&"qFN!$$DE`aQQKN9"5DG,iY0RIG$3#aZZ*rPc(I''h!XIN )R6TdQ`dSc'(lV8P8j&1b`KmV4alaF3c#'5U"%!Cc$[h`kRc!aZ(#(!N!`36-Dcb "XfpjbC9ah[#APm9-9Hb*%"fZNbmJ*)%X6eM$I$4hZ,eGMAA9ZCc*J1-%!S*!$45 "d2[JN!!9N!!ib'JHJel@'*JG0932+Sh,6I2f&c2rd@&keA2"(4)`JXiCb(ZfNKL Za2F'mVR"I1L$NIVB"b&8`8"qqi'9')ji[r`pF!i46&"H1[JA%*CPJ-Pb%+AL8KX 'cLm"N8[!U-SJ"bH%)9NDh1!3L48DdVb&M5"``aYaNMaBTA%)3!N#(0`)ab$%i&C PL%-G0U-qHP9)$KF5)4a)Q)Ba!%piHGbMr,)M%MPXMJLBdj`B%K$$&+b!"D#Fcac Z!$BGSLH8a#RF+"[RT91Q-J&I'%,ee"5I"$3K#&*B`K6Q3bBAM2+@8b`FrK`)`69 SNB-HA'0F91D'0f5S$Qj`3hc-'-8*aV)0Ri4"#iK`JaF%33BYF!N,@Y!pfme($A- )5f358KX!LZU1dkc)bm*!K[5pciRFc!lK`(QiGTS5PH)NTcR4k4,kIDf+c-5L"#f BZ)8*C6jN'-2Q-"FTJ6N'-Qd)!dJXd`#l"DF-b@S$X15`&)"j5b8XqGHiPTF!Ne) `+M5ih(bq`*-aa&)15$)2(fme+K"m*8N1QK"i91E6PQPSK@Hmk9,@LB)T3#')lNU 2a6Df+aGBK!iRU-KQT-222,MX$@0B3fG848HFC1F,@Jf$9b`k9$R1i9Pd3+P4b`# fAbNR$"3ab4XQT#(5C18-Ff!KV%EA1iXPj(9PD0M$d(!J18TfBj!!9Cm"CHDQZ%4 N)SRYjNR,mUBbb23ZpN42qI#eZmAd!3)!&%YTE'`J9d4&4LefDA*eFb"*EQPd'mH X!!%"UJ!Epc6rr`%!N!P!J0A1!"[(bJ!%i0S!N!FH58j*9$q3"!%!SDG3HD'RB$8 !!!-J!*!'!NF!N!6!@!#3#,aa!!!%#!K!J,H!!3i'&"+3!!@)J!mE4L5)d%QGJ!8 F84a)B8ND0Qa!A#&5a%J,1fRNe*N$)SQE0(6Q###Ba%N5+Mpq"+aj-fI1J3$J!3" $XDK4JU&13FPMG!#)!e#M5T9+S+V9UeJ*60h+YD[AVf$$LKdl&D%f-!jffU3#!*! !d5$krVPc%SFZd3"%`K#J+1+,45G@rXPl`F#*,VNSSJJjK562&#T53!JjJqS$L#m YN!$m``H,Am!c!3NYIZ&LXq%!0N"mN!$!)S!c*)'N"%%5$&BJ-`(4J(#cZ388`8* if`1M)3Jlep$FrE-R3rJdjI)J3)!9`B`3+F)KY(i0#*C`0YS@0ajCFR,PbjRrm92 L5[dC$$pi!!!TCr2Relp0(4PTpUPBSq1@&48XN`336j"N"f'D,aCF!+"r)&i" K!0#L@JY!U!FA!&U!d"ir'f+3!"iqrH(M))358QJ+'$i`m%U#!"K`KJ%Jk!'!#dj !Sm3E!""J"Me"i#-!1%2JN`!%3J!#!3C)!!&""U,`S!3!CRL$a$Rri'#B2q!`m3d (ri!"$891$&K(6Bm&FH!4@r)L!L+%E8P,BL!`%3S+,b#3!)SNK[e$4S!@`3(!#`R %!)`!)!3kP$epA3C+#5i!SSB"3PcL4&cQA2S21(e*m!%-(a#U4!"R%(#+%@!)-)S 4,b$4Sd@GIQVC&k+55S!T4k3U#TXAc@G%'Qk3!&''(#$%i!)-"!&9N!"##4(%d!% Fi&!!)34a!)!-DYe%N!!#E3A%&N%(E)$%!ak"*"***U'NdK`qqJ!!!: _._._._._._._._._._._._._._._._._._._._._._._._._._._._._._._._._._._._._._._._ | Juri Munkki jmunkki@hut.fi jmunkki@fingate.bitnet I Want Ne | | Helsinki University of Technology Computing Centre My Own XT | ^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^