[comp.virus] HyperCard Virus and Disinfectant

j-norstad@nwu.edu (John Norstad) (04/30/91)

Pat Ralston (IPBR400&INDYCMS.BITNET) writes:

>I have found John Norstad to be very responsive in the past when new
>Mac viruses developed.  John, are you working on this one too?  Or
>does anyone else know if the Disinfectant virus checking software is
>being updated to include the HyperCard virus?

Disinfectant does not attempt to deal with application-specific
viruses which spread via application scripting languages. These are
very different kinds of viruses from the "normal" kinds of viruses
Disinfectant was designed to handle. Modifying Disinfectant to detect
and repair these kinds of viruses would be a major project, and I do
not have the time or energy to undertake such a new project right now.

This recent "Three Tunes" virus is not the first HyperCard virus -
there was a very similar HyperCard virus named "Dukakis" which
appeared several years ago. Disinfectant doesn't recognize that virus
either.

Symantec's SAM 3.0 does detect HyperCard viruses.

John Norstad
Academic Computing and Network Services
Northwestern University
j-norstad@nwu.edu