[comp.sys.apple2] Virus on the GS?

u8530671@cs.uow.edu.au (Mark 'Scunge' Wann) (06/14/90)

	G'day. The following is being posted on behalf of a friend of 
mine (Brian) who is probably having trouble with viruses and wants to
know if there's a known problem with any of the software he was using
or if anyone can recommend any good virus programs for the GS. It'd be 
best if any replies were posted to the net rather than e-mailed to
me, because I don't know if the mail'd make it to me okay.

	The story so far: Brian has a GS (v3.0 ROMs) with one (?) disk
drive, 1.1 meg main memory and a 1 meg memory expansion card. Recently,
he grabbed a heap of problic domain and shareware programs and proceeded
to check them out. I believe that he was running most of his programs from
a 1 meg RAM disk he set up. He started up InstallDA to load some NDAs and
CDAs into memory. He played with them a bit, he used some utility programs
and somewhere along the line, there was a system crash and the RAM disk
went bye-byes.

	So, he reboots the machine and put stuff back on his RAM disk. On a
hunch, he also checked out what Vaccine had to say about his files and 
according to the .VAC files, things kept changing (particularly the first
file on the disk in alphabetical order), regardless of whether or not the
files were actually being used by any program he knew he was using.

	Now, the tricky bit: he decided to check out some more NDAs and 
got into WriteIt (I don't know which version) and instead of the expected 
window got a dialog box with a single button (labelled "Die!"). Having no
disks in his drives to corrupt, he hit the button and after a little while
was thrown into the monitor.

	So, for the moment, he's only using disks which he's sort of sure
mightn't be infected (much). You can see his problem, yes? My thanks in
advance for any ideas, recommendations and anecdotes you might have.

				Mark "Scunge" Wann
				u8530671@wraith.cs.uow.oz (or something)

dlyons@Apple.COM (David A. Lyons) (06/30/90)

In article <923@wraith.cs.uow.edu.au> u8530671@cs.uow.edu.au (Mark 'Scunge' Wann) writes:
>	G'day. The following is being posted on behalf of a friend of 
>mine (Brian) who is probably having trouble with viruses and wants to
>know if there's a known problem with any of the software he was using
>or [...]

Brian is probably *not* having trouble with viruses.

>[...] So, he reboots the machine and put stuff back on his RAM disk. On a
>hunch, he also checked out what Vaccine had to say about his files and 
>according to the .VAC files, things kept changing (particularly the first
>file on the disk in alphabetical order), regardless of whether or not the
>files were actually being used by any program he knew he was using.

What files were changing?  It's hard to make a judgement about this without
knowing any details.  I don't see any reason to be getting overly worried
about viruses here--especially on a RAM disk, a buggy DA or application
could be accidentally stepping on some RAM it doesn't own.  If it's always
stepping in the same place, it makes sense that it will mess up the
something in the same alphabetical position on the RAM disk, if the files
were copied there with the Finder from a View By Name window, for example.

>Now, the tricky bit: he decided to check out some more NDAs and 
>got into WriteIt (I don't know which version) and instead of the expected 
>window got a dialog box with a single button (labelled "Die!"). Having no
>disks in his drives to corrupt, he hit the button and after a little while
>was thrown into the monitor.

I showed the original message to C. K. Haun, and here's his reply:
----------
I'm the guy who wrote WriteIt!, and it sure isn't a virus.

The dialog box your friend saw comes up when WriteIt! is unable to load/start
up the tools it needs to operate, and it crashes.  Nasty way to exit, but NDAs
failing on Open is nasty anyway.

And he problably doesn't have the latest version, the current version of
WriteIt is 2.03, and is available on GEnie.

I really want to put this to rest fast, since WriteIt! is a very handy NDA,
and it sure as hell ain't a virus.

C.K. Haun
haun@apple.com
----------

>				Mark "Scunge" Wann
>				u8530671@wraith.cs.uow.oz (or something)
-- 
David A. Lyons, Apple Computer, Inc.      |   DAL Systems
Apple II Developer Technical Support      |   P.O. Box 875
America Online: Dave Lyons                |   Cupertino, CA 95015-0875
GEnie: D.LYONS2 or DAVE.LYONS         CompuServe: 72177,3233
Internet/BITNET:  dlyons@apple.com    UUCP:  ...!ames!apple!dlyons
   
My opinions are my own, not Apple's.

bchurch@oucsace.cs.OHIOU.EDU (Bob Church) (06/30/90)

In article <42492@apple.Apple.COM>, dlyons@Apple.COM (David A. Lyons) writes:
> In article <923@wraith.cs.uow.edu.au> u8530671@cs.uow.edu.au (Mark 'Scunge' Wann) writes:
> >	G'day. The following is being posted on behalf of a friend of 
> >mine (Brian) who is probably having trouble with viruses and wants to
> >know if there's a known problem with any of the software he was using
> >or [...]
> 
> Brian is probably *not* having trouble with viruses.
> 
The virus bogeyman is everywhere. In the student labs on the campus 
 here it's like sitting through a point 7 earthquake. The tables all
butt up to each other and the force of students literally throwing
themselves into chairs is enough to spill a glass of water if you
were foolish enough to have one sitting on the table. I've seen 
students move SE30's with built in hard drives to adjust for the
glare on the screen while the machine, and hence the internal drive,
were powered up. Whenever these machines crash (quite often) it's
blamed on the ubiquitous virus. A young man in our users group
had an Apple //+. One day the mother board went taking several
chips with it. He proudly announced to the club that a "worm"
had destroyed his computer. (seriously).
This would all be funny but all too often the last program ran is
blamed for harboring the virus. The resulting rumors can be deadly
for someone trying to pay his rent by writing and selling software.
 
********************************************************************
*                                                                  *
*   bob church  bchurch@oucsace.cs.ohiou.edu                       *
*                                                                  *
*  If economics isn't an "exact" science why do computers crash    *
*  so much more often than the stock market?                       *
*                                          bc                      *
********************************************************************