[comp.sys.mac.system] Hacked finder-is it a virus, or what?

sdbeck@mac.cc.macalstr.edu (06/20/91)

One of the Macintoshes in the Psychology department has a new, enhanced Finder.
Maybe someone can tell me something about it...

It's not recognized as a virus by Disinfectant 2.3 (yes, I know 2.4 is
current).

As far as anyone knows, no damage has been done and no one else has been
infected.

However, it's definately hacked. I'd like to know if anyone has heard of it
elsewhere, or if its local.

-The menubar of the finder now reads "Kill, Maim, Destroy, Eradicate" although the
contents and function of the items listed under them seem to be fine.

-Several dialog boxes and alerts have been modified-one now reads "XX files
remaining to be messed with" instead of "copied".

Any clues would be appreciated; in the meantime, I'm going to copy it for
archival purposes and then reinstall the whole system.


Thanks

-Dan Becker 

mcginnis-john@cs.yale.edu (John Mcginnis) (06/20/91)

In article <1991Jun19.162838.675@mac.cc.macalstr.edu> sdbeck@mac.cc.macalstr.edu writes:
>One of the Macintoshes in the Psychology department has a new, enhanced Finder.
>Maybe someone can tell me something about it...
>
>It's not recognized as a virus by Disinfectant 2.3 (yes, I know 2.4 is
>current).
>
>As far as anyone knows, no damage has been done and no one else has been
>infected.
>
>However, it's definately hacked. I'd like to know if anyone has heard of it
>elsewhere, or if its local.
>
>-The menubar of the finder now reads "Kill, Maim, Destroy, Eradicate" although the
>contents and function of the items listed under them seem to be fine.
>
>-Several dialog boxes and alerts have been modified-one now reads "XX files
>remaining to be messed with" instead of "copied".
>
>Any clues would be appreciated; in the meantime, I'm going to copy it for
>archival purposes and then reinstall the whole system.
>
>
>Thanks
>
>-Dan Becker 

I suppose that this could be some new virus never encountered before, but I
think that is fairly unlikely.  What I'd guess was that some clever person with
an unusual sense of humor decided to have some fun with ResEdit.  Fairly easy
really.  Just change the MENU and DLOG resources and the result would be
exactly what you describe.  There is no harm in it, really, but then there is
no harm in reinstalling the system again either.
-- 
mcginnis-john@cs.yale.edu
jray@yalevm.ycc.yale.edu
john_mcginnis@yccatsmtp.ycc.yale.edu

john@newave.UUCP (John A. Weeks III) (06/28/91)

In <1991Jun19.162838.675@mac.cc.macalstr.edu> sdbeck@mac.cc.macalstr.edu:
> However, it's definately hacked. I'd like to know if anyone has heard of it
> elsewhere, or if its local.  The menubar of the finder now reads "Kill,
> Maim, Destroy, Eradicate" although the contents and function of the items
> listed under them seem to be fine.

Ah-ha!  Someone just discovered ResEdit.  Things like strings and dialog
boxes are stores a things called "Resources" on the Mac, and the program
called "ResEdit" will allow you to change these things.  Although ResEdit
can be fun, it can also be very dangerous--you might want to reinstall
you system software just to be on the safe side.

BTW, there are a few fun finder hacks floating around.  One adds double
arrows to the window sliders, and another changes your trash icon to be
an IBM PC.

-john-

-- 
=============================================================================
John A. Weeks III               (612) 942-6969             john@newave.mn.org
NeWave Communications, Ltd.                        ...uunet!tcnet!newave!john