[comp.sys.mac.misc] Two New Viruses, Disinfectant 2.1

jln@acns.nwu.edu (John Norstad) (08/21/90)

Disinfectant 2.1
================

August 18, 1990

Disinfectant 2.1 is a new release of our free Macintosh anti-viral 
utility.

Version 2.1 recognizes two new viruses which have been discovered in 
Ithaca, New York.

The first new virus is a new strain of the MDEF virus (MDEF B).  The
main difference between the old MDEF A strain and the new MDEF B strain
is that the MDEF B strain bypasses the Vaccine protection INIT.

The second new virus is named CDEF.

CDEF is very similar to the WDEF virus. It only infects the invisible 
RDesktopS files used by the Finder. It does not infect applications, 
document files, or other system files. It spreads from disk to disk 
very rapidly.

Although the behavior of the CDEF virus is similar to that of the WDEF 
virus, it is not a simple clone of WDEF. It is a completely different 
virus.

The virus does not intentionally try to do any damage. It does not 
appear to cause as many problems as does the WDEF virus. As with 
all viruses, however, the CDEF virus is still dangerous.

As with the WDEF virus, you can remove a CDEF infection from a disk 
by rebuilding the Desktop file.

The CDEF virus is named after the type of resource it uses to infect 
files. CDEF resources are a normal part of the Macintosh operating 
system, so you should not become alarmed if you see them with ResEdit 
or some other tool. Any CDEF resource in a Finder Desktop file, however, 
is cause for concern.

Version 2.1 also corrects a few errors in version 2.0, including 
incompatibilites with A/UX 2.0, Icon-It!, Spy!, SuperClock, and Rival.
See the "Version History" section of the 2.1 online manual for details.

The Disinfectant sample source code has also been updated to version 2.1.

Disinfectant 2.1 is available now via anonymous FTP from site 
acns.nwu.edu [129.105.49.1].  It will also be available soon on 
sumex-aim.stanford.edu, rascal.ics.utexas.edu, 
comp.binaries.mac, CompuServe, GEnie, Delphi, BIX, MacNet, 
America Online, Calvacom, AppleLink, and other popular sources 
of free and shareware software.

Macintosh users who do not have access to electronic sources of 
free and shareware software may obtain a copy of Disinfectant by 
sending a self-addressed stamped envelope and an 800K floppy 
disk to the author at the address below. People outside the US 
should send an international postal reply coupon instead of US 
stamps (available from any post office). Please use sturdy 
envelopes, preferably cardboard disk mailers.

John Norstad
Academic Computing and Network Services
Northwestern University
2129 Sheridan Road
Evanston, IL 60208

Bitnet: jln@nuacc
Internet: jln@acns.nwu.edu
CompuServe: 76666,573
AppleLink: A0173