dmg@lid.mitre.org (David Gursky) (10/24/89)
Superclock (in the general case) is not a virus. It is a legitimate cdev that displays the current time-of-day in the upper right hand corner of your Mac's screen. The current version is 3.5 (although I thought I saw a 3.6 yesterday). It is more likely that the "Superclock" virus is simply an occurance of (if I have to pick one) the INIT 29 virus, or a strain therof. Superclock is not a stand-alone application; it is a "control panel device" that is loaded into RAM at start-up. In the MS-DOS world, Superclock would belong to the class of applications called "TSR"s (Terminate and Stay Resident). In the Macintosh world however, cdev's (and their sister's RDEVs (Chooser devices) and INITs (classic TSRs)) contain their code in resources called (appropriately) INIT. Classic Macintosh viruses (such as nVIR and strains, Scores, Peace, and ANTI) infect code in CODE resources. Only INIT 29 infects code stored in INIT resources. Another possibility is that the "Superclock" virus is a wholly new strain. While this is not impossible, I find this less likely. The Mac is a not as easy a machine to program and acquire expertise on as MS-DOS platforms. Consequently, there is simply a smaller number of potential virus-writers (proportionally) than in the MS-DOS world. David M. Gursky Member of the Technical Staff Special Projects Department, W-143 The MITRE Corporation