[comp.virus] Desktop Manager for WDEF/CDEF

MAIMER@kuhub.cc.ukans.edu (Big fish man on hippocampus) (08/26/90)

What an idea... maybe.

In order to avoid the CDEF and WDEF viruses, won't the Desktop Manager
work?  By removing the Desktop file, they won't be able to infect that
file.  Also, this is, I believe, shipped with new Mac systems.  I
understand that the Desktop Manager and its cohorts, Desktop DB and
Desktop DF, are more efficient than the old Desktop.

The "Desktop" is not recreated if you "rebuild the Desktop" after the
Desktop Manager is installed.  (I don't know if the Desktop is removed
when it is "rebuilt;" I just removed mine by hand.)  I guess it updates
the DB and DF files.

When I installed the DT Manager, documents weren't finding their
creator until I rebuilt the desktop, but I haven't had any problems
since.

Let me/us know if there would be any problems with this.

	++++++++++++++++++++++++++++++++++++++++++++++++++
	     |\   \\\\__		Anthony Maimer
	     | \_/    o \                       __
	      > _   (( <_                      /  |
	     | / \__+___/                     /   |
	     |/     |/                       /o   /_/|
	                                    <  ))  _ <
	maimer@kuhub.cc.ukans.edu           \     \ \|
	                                     \    |
	+++++++++++++++++++++++++++++++++++++++++++++++++

jaustin@helix.nih.gov (James Austin) (09/02/90)

      Unfortunately, Desktop Manager will not completely protect you
against CDEF and WDEF.  DM generates its own files (Desktop DB and
Desktop DF) and ignores the old-style Desktop file completely, so if
you delete that (which DM does not do) then there is no Desktop file
for viruses to infect ON YOUR HARD DISK.  However, DM does not change
the way floppy disks manage their desktops, and it doesn't actually
keep the viruses from loading into memory.
      If you were using DM and mounted an infected floppy, those
viruses could not infect your hard disk, but they would load into
memory, where they would remain until you dismounted the floppy.
While in memory, they seek out other Desktop files to infect, so they
could still spread to other floppies or other network volumes.  Even
if the Desktop file on a volume is not being used because of DM, they
can still infect it, and that still causes problems, especially with
AppleShare servers.
      DM is still worth using, but it's not a cure.  As it is, DM is
still officially available only with AppleShare, but Apple really
doesn't care if you use it elsewhere (though they also do not support
such use).  System 7 will adopt a similar scheme for managing desktop
information on hard disks, but like DM, it must leave floppies along
for compatibility.-- Disclaimer: My opinions neither reflect nor
influence those of the NIH, where I have the authority of a small
beaker.

jaustin@helix.nih.gov