[comp.sys.mac.system] virus? Finder wants res

boz@eleazar.dartmouth.edu (John Boswell) (03/06/91)

Hi.
	The last posting was garbled, I see.  Well, the gist was that after
upgrading to system 6.0.7, Gatekeeper consistently complains that applications
are trying to violate res(sys) priveledges.  It seems to happen when they
try to access a printer driver.  Finder, Hypercard, all do this.  If I grant
Res(sys) privs, everything is fine.  What gives?  Disinfectant shows a clean
disk, not even suspect files.  ???

thanks in advance,

John Boswell
Dept. of Chemistry
Dartmouth College, Hangover, Nude Hampster 
boz@eleazar.dartmouth.edu

llvvll@mixcom.COM (James R. Macak) (03/06/91)

In article <1991Mar6.041652.1442@dartvax.dartmouth.edu> boz@eleazar.dartmouth.edu (John Boswell) writes:
>Hi.
>	The last posting was garbled, I see.  Well, the gist was that after
>upgrading to system 6.0.7, Gatekeeper consistently complains that applications
>are trying to violate res(sys) priveledges.  It seems to happen when they
>try to access a printer driver.  Finder, Hypercard, all do this.  If I grant
>Res(sys) privs, everything is fine.  What gives?  Disinfectant shows a clean
>disk, not even suspect files.  ???
>
>thanks in advance,

This is due to a problem between GateKeeper v. 1.1.1 and System v. 6.0.7. The
problem is fixed by a patch to GateKeeper that is applied by GateKeeper Aid v.
1.1. Here is the author's explanation of the problem:

-----
Gatekeeper Aid 1.1 incorporates a retroactive fix for a conflict between
Gatekeeper and System 6.0.7.  This conflict manifests itself as Res(Sys)
privilege violations (this conflict manifests itself when the ImageWriter
printer is chosen and applications are executed under Finder, rather than
MultiFinder).  This was the side-effect of an unexpected change in Mac OS
6.0.7 and not a bug in GateKeeper.
            
(c) 1990 by Chris Johnson
-----

So all you need do is obtain GateKeeper Aid v. 1.1 and have it load _before_
GateKeeper.

Jim Macak


-- 
macak@mixcom.UUCP (James R. Macak)          "I'm curious, Doctor, why is it
uunet!uwm!mixcom!macak                       called 'M-5' and not 'M-1'?"
<< All my own opinions. >>              

rsfinn@neutron.lcs.mit.edu (Russell S. Finn) (03/07/91)

In article <1991Mar6.041652.1442@dartvax.dartmouth.edu>, boz@eleazar.dartmouth.edu (John Boswell) writes:
|> ... after
|> upgrading to system 6.0.7, Gatekeeper consistently complains that applications
|> are trying to violate res(sys) priveledges.  It seems to happen when they
|> try to access a printer driver.  Finder, Hypercard, all do this.  

This is a known problem with GateKeeper 1.1.1 and System 6.0.7; try
getting the latest version of Gatekeeper Aid (1.1) from the
appropriate archives (e.g. sumex-aim.stanford.edu), which incorporates
a "retroactive workaround" into GateKeeper to fix the problem.  (Or
switch to Disinfectant's INIT, which is what I do; it's nice to be
able to protect against new viruses, but in my experience the updates
to Disinfectant make it here long before the viruses do.  Disinfectant
INIT and Gatekeeper Aid work well together; Disinfectant INIT will
block WDEF/MDEF/CDEF style viruses, but Gatekeeper Aid automatically
removes them as well, which is handy given their virulent nature.)

-- Russell Finn
rsfinn@lcs.mit.edu

aslakson@cs.umn.edu (Brian Aslakson) (03/09/91)

boz@eleazar.dartmouth.edu (John Boswell) writes:
>	The last posting was garbled, I see.  Well, the gist was that after
>upgrading to system 6.0.7, Gatekeeper consistently complains that applications
>are trying to violate res(sys) priveledges.  It seems to happen when they
>try to access a printer driver.  Finder, Hypercard, all do this.  If I grant
>Res(sys) privs, everything is fine.  What gives?  Disinfectant shows a clean
>disk, not even suspect files.  ???

1.  GateKeeper is to protect against unknown viruses wanting dangerous
permissions.  Granting permission left and right defeats this.  You might
as well remove GateKeeper.  (If chrisj says anything different, he's right).

2.  The latest, greatest versions of GateKeeper (including a fix for 6.0.7)
are:

GateKeeper 1.1.1
GateKeeper Aid 1.1

Get them, run them (first), live them.

They can be found at many fine ftp sites, I recommend the excellent mirror
of sumex-aim at:  wuarchive.wustl.edu (mirrors/info-mac/virus/ 
gatekeeper-111.hqx
gatekeeper-aid-11.hqx
 
and since you're there:
disinfectant-24.hqx).

-- 
Brian Aslakson

aslakson@cs.umn.edu
mac-admin@cs.umn.edu  <-= Macintosh related