[comp.virus] WDef and Gatekeeper Aid.

C0195@UNIVSCVM.BITNET (Gregory E. Gilbert) (12/19/89)

I booted some Macs with Gatekeeper Aid installed this AM.  I was
immediately presented with a rather sharp looking dialog announcing
that the "Implied Loader ABDS" virus(?) was found and removed.

Is this the Wdef virus?  If so, why not call it such AND what is an
"Implied Loader ABDS".  Of course, if this is Wdef you can add the
University of South Carolina to the list of where the virus has
spread.  If not I apologize to Chris Johnson and all subscriber's for
my ignorance (it has been peaking lately!).

Greg

Postal address: Gregory E. Gilbert
                Computer Services Division
                University of South Carolina
                Columbia, South Carolina   USA   29208
                (803) 777-6015
Acknowledge-To: <C0195@UNIVSCVM>

dplatt@ames.arc.nasa.gov (Dave Platt) (12/20/89)

C0195@UNIVSCVM.BITNET (Gregory E. Gilbert) writes:
> I booted some Macs with Gatekeeper Aid installed this AM.  I was
> immediately presented with a rather sharp looking dialog announcing
> that the "Implied Loader ABDS" virus(?) was found and removed.
>
> Is this the Wdef virus?  If so, why not call it such AND what is an
> "Implied Loader ABDS".

The "ADBS" resource in the Desktop file is almost certainly not a virus.
Rather, it's the signature for the Adobe Separator application.

Unfortunately, "ADBS" is one of the resource-types that Apple has
reserved for its own use... per Inside Mac V, resources of this type
hold code which acts as an interface to the Apple Desktop Bus and its
devices (keyboard, mouse, etc.).  Because this resource-type can contain
executable code, Gatekeeper Aid considers that it shouldn't be in the
Desktop file.

I don't know how a commercial application ended up with a signature-
resource that's identical to one on Apple's list of reserved types.
there are several ways in which this could have happened... all of
which would appear to involve a bit of an oversight on someone's part.

Removing this particular resource from the Desktop file might have some
adverse effects on the Adobe Separator application.  In particular, I
might expect to see its documents revert to the generic icon, and you
might not be able to double-click on a Separator document and launch the
application.

I believe that Chris will be updating the documentation for Gatekeeper Aid
to warn of this problem.
- --
Dave Platt                                             VOICE: (415) 493-8805
  UUCP: ...!{ames,apple,uunet}!coherent!dplatt   DOMAIN: dplatt@coherent.com
  INTERNET:       coherent!dplatt@ames.arpa,  ...@uunet.uu.net
  USNAIL: Coherent Thought Inc.  3350 West Bayshore #205  Palo Alto CA 94303