[comp.virus] WDef problems - it doesn't go away

DUCKENFP@carleton.edu (Paul Duckenfield (Consultant, User Services)) (02/19/90)

	As I mentioned in a previous message, we have had (and
probably still have) WDef B running about Carleton College's Macintosh
community. So far, it appears to have restricted itself to the public
labs and has yet to break into the general computing community. I have
found that RAM disks on public Macintosh Pluses have greatly limited
the spread of the virus because no single machine can have the virus
for very long (invariably, we have to reboot each machine every couple
of hours). Even if a RAM disk is infected, it is unlikely to infect
many other users since the RAM disk will be reset in a matter of
hours. This is our first line of protection. At the moment, we are
redoing the master RAM startup disks so that they have WDef protection
as well. That will be our second line of defense. Our final line of
defense is (hopefully) the responsibility of the individual user to
obtain virus protection from the Micro Lab and put it on his
Macintosh. With a good bit of publicity, this might be successful.
	Another problem which we have had to deal with is recurring
system crashes on our AppleShare servers even after the eradication of
WDef. Although WDef if "officially" gone thanks to Disinfectant v1.6,
the servers still seem to crash regularly. It appears that WDef, like
polio can be cured, but it leaves lasting damage. The only solution I
have found is to delete the unused DESKTOP file on all server volumes.
This brought the number of crashes down from four a day to zero for a
week.

		Paul Duckenfield
		Carleton College
		CC User Services
		Micro Consultant
	      DUCKENFP@CARLETON.EDU