nVIR is back!

Article View: comp.sys.mac

Article #34905

#34905

From: Shawn Drew
Date: Tue, 29 Nov 1988 17:17

21 lines
1356 bytes

nVIR is back, and it's meaner than ever!

I think I've discovered a new strain/mutation of nVIR.  This one seems to
change the name of some programs infected with old nVIR to "nVIR" while
changing the icon to the generic application icon.  Also, the old nVIR
used CODE ID#32 in applications, the new nVIR uses CODE ID#256.

It is not stopped by KillVirus!  KillVirus doesn't even notice it!  This
may be do to the new CODE ID#.  The only way to stop it that I know of
is to get in there with ResEdit and yank it out!  Install a nVIR resource
of ID#10, (name it "nVIR Inhibitor" for your own peace of mind) and replace
the code of CODE ID#256 with $4E75.

You have been warned!


   Disclaimer:  The opinions expressed in this article do not represent
    those of my employer.  They're for sale, if you want them.
                      drew@cat18.cs.wisc.edu
                 Does the name Pavlov ring a bell?

Technical Details

Message-ID: <2051@puff.cs.wisc.edu>

Path: arc1-ca.pugleaf.net!utzoo!utgpu!watmath!clyde!att!rutgers!uwvax!puff!cat18!drew

Show Full Headers

Complete Article Headers

Path: arc1-ca.pugleaf.net!utzoo!utgpu!watmath!clyde!att!rutgers!uwvax!puff!cat18!drew
From: drew@cat18.CS.WISC.EDU (Shawn Drew)
Newsgroups: comp.sys.mac,comp.sys.mac.programmer
Subject: nVIR is back!
Keywords: nVIR, virus, death, destruction
Message-ID: <2051@puff.cs.wisc.edu>
Date: 29 Nov 88 17:17:55 GMT
Sender: news@puff.cs.wisc.edu
Reply-To: drew@cat18.CS.WISC.EDU (Shawn Drew)
Organization: U of Wisconsin CS Dept
Lines: 21