Article View: comp.sys.mac.apps
Article #7636Re: My mac is infected -- what to do?
From: Joel B Levin
Date: Tue, 05 Mar 1991 17:08
Date: Tue, 05 Mar 1991 17:08
33 lines
2173 bytes
2173 bytes
In article <91064.094356GFX@psuvm.psu.edu> you write:
| o the virus interacts with Gatekeeper aid. If I do not put GK Aid
| on my drive, there are very few sides effects, so far. IF GK Aid
| is in, I'll get the "Desktop needs to be rebuilt" message each
| time I boot, or re-enters the Finder.
|
| o the virus is undetectable by Disinfectant 2.4 . I get, however
| several warnings of either kind: (a) "the resource fork is
| damaged or in an unknown format..."; (b) "not enough memory to
| check." 10 files trigger either message.
|
| o For at least one application (Disinfectant), I cannot change the
| application size in the Get Info window. When I close the window
| I get an error [-199] Other applications are unaffected.
|
| o If I use MacSnoop or resEdit to look into the desktop, I get an
| error [-49] and a message tells me that the file is already
| opened with write permission
These problems indicate that the first thing you have to do is reboot
WITHOUT Multifinder. Then you can look at the desktop; then
Disinfectant can run properly (and you may need to capture a fresh
copy, if it detects problems within itself).
Scanning and especially disinfecting under Multifinder leads to
questionable results, in any case. See the instructions in
Disinfectant's help window.
/JBL
==
Nets: levin@bbn.com | "How does a mouse let me move the cursor anywhere
or {...}!bbn!levin | I want?" "What are address busses?" "How do
pots: (617)873-3463 | icons work?" --Time-Life Books
Technical Details
Message-ID:
<63136@bbn.BBN.COM>Path:
arc1-ca.pugleaf.net!utzoo!news-server.csri.toronto.edu!cs.utexas.edu!usc!BBN.COMShow Full Headers
Complete Article Headers
Path: arc1-ca.pugleaf.net!utzoo!news-server.csri.toronto.edu!cs.utexas.edu!usc!BBN.COM From: levin@BBN.COM (Joel B Levin) Newsgroups: comp.sys.mac.apps,comp.sys.mac.wanted Subject: Re: My mac is infected -- what to do? Message-ID: <63136@bbn.BBN.COM> Date: 5 Mar 91 17:08:58 GMT Sender: news@bbn.com Followup-To: comp.sys.mac.apps Organization: Bolt Beranek and Newman Inc., Cambridge MA Lines: 33 In-Reply-To: <91064.094356GFX@psuvm.psu.edu>