D1660@AppleLink.Apple.COM (SoftPlus, Paul Cozza,PRT) (10/24/90)
For SAM 2.0 Users: A new strain of the Garfield-virus (or MDEF-virus) has appeared which can cause system crashes, error messages, or corrupted files once the virus takes hold in your system. If you have SAM 2 configured in Standard level or above, generally, it will either issue messages "Attempt to bypass SAM Intercept" or messages stating 'that a suspicious change to or addition of an MDEF resource' was being made (which specific messages are displayed depends upon a number of factors, such as what machine is present, whether MultiFinder is running, etc). By preventing the addition or change of an MDEF-resource Garfield is prevented from spreading. To eliminate the original source of infection you should replace the infected file with an original uninfected copy. As an alternative, you may obtain an update copy of SAM Virus Clinic from Symantec Corporation, which repairs files infected with *THIS* strain of virus also. You may add a virus definition to both SAM Intercept and Virus Clinic which will cause to identify this strain by name. The virus definition for this strain of Garfield is: Virus Name: Garfield (or MDEF) Resource Type: MDEF Resource ID: 0 Resource Size: 556 Search String: 4D4445464267487A005EA9AB (hexadecimal) Search Offset: 448 Paul Cozza SAM Author