🚀 go-pugleaf

RetroBBS NetNews Server

Inspired by RockSolid Light RIP Retro Guy

Article View: comp.sys.mac
Article #9256

Re: WDEF "virus" & symptoms of presence

#9256
From: jacobson
Date: Sun, 10 Dec 1989 10:40
143 lines
9408 bytes
Heres some more info on the WDEF I found today:
 
For those curious about the curent "virus" WDEF here is a macpaint file of the
screen dump from resedit while I was looking at my desktop before I
rebuilt it. It is binhexed version of a stuffed file so you first decode it and
then unstuff it.

(This file must be converted with BinHex 4.0)
:%h"TBh4eFQ8YEfBYGf4PCLjcDA3!8dP8)90*9#%"!!!!&Ed!!!!!Nd96593K!!%
!!"@pFNaKG3%!!!!!!!!!!!))8f0bC@9Z)$!Z-"`!38C%!#CVc!!+!#DQhJ!!!!-
!*Ue5!!*i%!!Q26)!"+IF!#DQhJ2H!2m!*J!"!!!!*Me-8%j84de36P3"!+'QVl+
KTUqd!!!!!!!!3rX!!!!!!!!90`!!M)%!!!!!!!"X$`!##Ka)X+$"J`J6+Pc)X+(
$Ka!M5Ta)XD,&LaJcDYc)XD0(L2L'"Ib3!#mJ1*%!$T3%!!cPJ*)$!!8%CLaJ!*J
b!`#U#H!QJ!Ff4mk`#@m'"J!ar38%dqaR3!IJ!'!BB"-3M+-'J#J&`"6!K*(`T-l
`d$232"i!$"`ie)J6RkCI!A`!*RCSJ%&'8c*!jNb''EJMkAUBBAGFhJ'-MM'$mGF
V@,%rHZ)p'Z!CXm@0ihi)Lf%'$-Pj!6"MJ"R`ckLGBi!q5S!C%fCq64ZJfjPXJ(M
c'#!pG)JCKmDj!!3I,Ka!X(mPIpMDeQCjFqE1Sd1IrVbkG1[8Vf[2RMblGqcJYiI
r,Pjkm[(Sbj0IRjjkF[AYim1I$lflI2EdlimrRlmrr[rJVA3,1[q8S*preUfN66S
!Q"!!JK"ZXj)E$$S)B)69V@4,K3'dJf&r#R,iiB85"Z4'53F%N!!*2!B%a!-2*9P
i))NC"Q4,53+SL)P5!4KK4S`GMLLIJLLUQ)NYC["J`)m02NKMK"-@Q8NQaTKKaT*
!2UPP'aS@Q8mQKPM*!*-1HVJPL!&T)b@BC[L"!CP1cMKMP#NC'5BBM'8T*i* GeMQ
P)@5)!3DFCZjj)C&qaQ-)(Mci!@163Y)h)BGRdJL6,51Pmmm)qaJk*&,D"!3"Jb-
d%1Pk-,NK+UN19"SI6,Imm`mmT$lJkA``K3V!U!#8HZTq5+N+!!a+'6$!$$li`%G
+5K833&J$k-42VkhHbYkP!4'EeV'HJ3%!!md'J!P5d[CUkkrDjHV(X%T&`#d-B-$
K!4[ar#-Z2)BGm`JJ5[RUURUT$J%!21fq#`Bb$-3aC5"66K)')m`!dfqek,U(P#e
$!!*,`B6aJ!Fi$)5am*6$"!1aa1CDQekZ@'M-FEG`K$`b2Z-%FR+rT[k,DV"!Z!b
!Zi6"Li2-Q6!-b"`Q4cbacZKGkSA2lXV3,5C%-jc)$!mVRA,&#B,DmmBr$m"2X[%
b!%Bm4F1$,`ckmYYVcLT[PbSA'VX6%!2p8-ZdH*GqEIHhHBp`lYlFJIS(),5qcE9
j`@E,+Z%"AKc3$`5+%$GjZ6UZ115-$b!X$)pI([N!Q!jEUqMTJUUj[kK29e)$Ri0
``L(2!)*!@&c0ShIV0CU+&L`JN!"!"!)!))")3*!!k#iilp'pVXd3i-!L!JNN%)m
!)6dKS$cFLjF)1a!3`#)"%G8AMhd!fZrH2CF!Q!Sq,"83FF)MjMm352V,VhpMqpU
!$drmjEYHpVDR2qqjiAhA#q$jm%FacM(RGEC!)#''9ca%2!!3bGZD!j[M2!6b"KR
&`adB#,M"jD6U$r#!4HM@Kbh6DC!!HCPc)HZkPkV90C!!Gbd%h3XA&d-GcY#"0C6
K$EQ@`p2T,eHr)aAhJ"JXk+P3I4[X@rL-@-*F[8q*"8b9reBBaBYGFBHFXq)80mH
m%RRZLb-B)Z3ZKF)RjUq+UT2K%PXA4"qU8A4&"#2UHSM&%TVaFec%SH4N1$JBJQT
G2TaMa3)'!$J%NSJAbjJMpBJZ+`*LNMqN)mmZqFJeHT'6P0bE*6'T5-*T%C4Tp#2
l50Fc6"D5KiC$C5N[9mG1iR'3!$jmC4MMQ-JX0Nk)UXcM'`dj!&hedSqeK+)J5BH
@A*D4Jk##hM(,U%8)f$'BAV3Q&BRC2ff5NBBmmfBURpQh#$McL&icCaqT'5`8*Qk
F,-6P0Q&Cc0A0mP6*K'FA5EFkAHk4PqX%TqF%!%abAU`!K(cQrSU*!)d&P)QHJ`!
3h(M(AedU"+"`ScmV#5SK3-'0pp4CUNi!LRG@P'QALJ!F0+V3A0d1&ZS)b!'mm3m
!l#09"B!"6!0#!'m%T!HA)ZK1!G$6J0LJKc%PUNm"X)-kaY3!"GM(2hiK+hr%9+S
!k%81BcS!!K$8E3Xi9V+@0BDS"!!F$P!+!3B3&@2K`kK)"B!%#U!2!&$e(ri`'!$
'm*N"A%@YIYf@8V#k#kFLaDX!F&X&p-TAT-#!"pNB4ejM%!jMR1%4(kJV!)#+bjK
fJ+jfV5TMBI!$[f,!-$2JPJQ'NB&-!!+V#c8Q9a(V0JY`bf0llHY9KN%BEKeL%+e
pE8#D'Lbd`-1cS,eVAS2Q,Ek@GVHpR8%mMM'!i'*9Uj%%ah%2qe@Pf*DjZA8X"RL
EfU'F!lLZh3GF[4Bqj0C9Z313!"Um`QYDmKj,!QCJEATV@YK`lV5Vh3A!BXIQJqD
D&4`B#)CK"K#1bSB"XjVP,#[EQjDS6V@Ul1M*8@!VaU%5`"`"`B"QLAY'#L[eTe,
dm&+2DVJ8*[8!kUMT1Ha4dj[q%JC**8"5%I"@!8"JXe[PD9)C8&F#b!3#)'"a2BF
9d`-3!!!i')FMSZ`)T@3J$X(`3@9mJBm$F!!132""(*`KN`F8B!,2)!)3GJ8&%Rq
Zb8mZ!J@L8!3#4-(+LKJ"#!5!!K!J!!'L3!3`3+#)&`3N!3@3!%!58#!U4%LiG$K
15CcRA!4b4-$+#JJ"#!#!!Klm@45*!!)2#Lf6"#4!d4#)5J3)S'4Y%$656JD!R1P
-J8X$)!-5#!&DRZ"M3#X##!+)`c2SBQT&4q$(%K#!Qa%+kdR6fYBC%)'Q!B!)!IK
C&)X!K`!+(C8%4%!+5BK!@#J3J%FhG,ZaR[@XV5`%6D02"0G'"""%81L`H&X@58M
"5!i3@iRZ00C8TV+9ma%-%!`!(4`!JCI"c!&KPcN%D#C#@&EYCSak1+B%D)"-!!#
#D3PJeBrfk-@c"``FVEV9*0dZ84R%%T2c`mdUp6$,`B#M(j[EaC+'XT3&IZX*[--
A!$L#$lSXCQ!dr"KJ)!!3*2i!#)6Pakh1kEqGAHFlheS'!!!&!*!!!BSrJd)4)+!
h#J#4&5*))J&8J)4FrQ(MJ3*JkV+QY+@Y,!8!m#)!51KkeX'qlE%A)!T%L%3#F+"
f$#!#ZraNFXl96B'dhRS5`4#!!)l!!`J-B03J))!qaNk!D2!"%SP)Zea&d1TX`6R
ZclDb2L4rF&"XqZYq9J6R!5pi#"3H%IheR1NA6qNj@cRC)J"!h[d-H`M)(K!%Q),
C%`!!Y8Y!")rH2F"h,Q8V6d!F(!Lk$a4HG"mNiKK%E3,6"bB94-4fpd50LJ#HlfE
d%d$pKNHm,4#Cih)%""4j@crTFb8`PEmI!!*JH,RR"KN$G`&h$P9fDh&`$0NA"&q
fF%"`G$ha!"r6G'(aI)rf0DHRERCQCB+!!U)!!--J!SJ!D)*'D'-(!!P3""$!I,F
A@aV)Hh4'$PDA!I+!!S)3!%9!JPNREjJ(#!'`JLeSHk2RCMf$EP6RHlHf#1K!#!+
3!!3FJ!J"!!,b*J,k%!)pXB,`N!!!4"KrID-a'pKl05KlL$!!la"SePD&LK"m3FL
#A1KmqqFeB#L$khCVXUGf38##"%##mkB)**!!K@lBKEKh5JDiF`KSCA*`!Mi!!!i
)"`r!#3bA#,86!!q3!!F4B)'MpfL(if(S!!!+%!""m@2PGhk+4e5GU!!Y!S"F%4$
XCeK%G3imT9i"H(K"pSSpS3!3i((29hU+0he6GSLh"J&(3!!"%!`F!!%"`!%4!!`
%!!G(N!!58dB2AP!!U$')0aD'G0D"Y`B$b-!)!M!#)J!$!b!#-J!#$)!)b)"m88!
&P"!&"B"Xd"GNk5Ch04J&5)!p*5!#%&!!)J!&)%!"SDD180#1lcL+kY+,5HJ%9LB
*``J!5D#2#F!"N!!!"#5J$d&!9&q!!jIJ$G4BK)`%"pKBKaQ`$dd)!)mJ#K$`!++
!$i$J!iXJ$N39"463MLaBI[*AJ#'TK"N!!IFB!!'JMcmC!85&#%33Nqa)Cr$BDLe
6L,qBJ$XjM!afM-Ni!H"!!)M`")"`!*'!!p+B!p8iJ$&)9##f+lSBMaIc0#$*8r"
RITB8DHN(J+dB,(6MP[mhLr)AJlk)!qIJ$&D'C4`3!!`)"mQiM-hiM!$`$$K`$ij
!"&'aLlPb1'NjMpN)EB)`MRa'JZ0BMZHBMN%)"$6jB`*S@**CDG!f$`8(!#p!JJ8
J!&,`MiQ!")!`!)Q!"j63"88!$CNSMe4h!C'!Cp1'$)'@!!3J#F%M"l!CK%4`#CA
3"e"JN!#mP*23TJM6"S)@K!Mk!!)ZL3j!Q!"%3!PH8!50+3)NpJDbJS5S*fI4'3)
L`'H"&J!3)!'CK`M(bCf8!!9&%'+dL"5a-LZRGi"mUB$'#*KI&J!q3*M11)'*ZCM
KU@63iApVQA[2NCC[UAq2aK`H0TBSi(''Ye!0QQ2U&jF$%+(pDBMrQ3&cF!l%b)!
3i'4a`)`(qK-i!!+2!*ifH5N@'T)%!'f!J!,H#))`J!#-!(DE@@T%%!#*8*11L43
G5SGcGf[`J!+8`'HJm'18!(B!f6-$N!!-4#!#4`UDeKLLba'CZqQ8mNN+!F"ePNF
#B%F#FR#4"*!!"(a!!SR3"q&CS@d!Gi`(EBL!#,iJT6rQ#f$RNM$jT[+6$$@jS6#
aT+0CDeDfTdi)JK"`2@"RP89*U#$3T4k*&#+DFrjTCA"`##PkM#cUSPJj!'NQSc6
UK4GcSc`&L`!!",+BT!1`T+EB%c%KLk'TUF[a"c%'!2b!S@9TTkr3Urb`PKcD(1!
`SVpBSJ[iPbSkUK)i!)m3Siq!!KFSRM$a('#!Sp%*JZcjSd%DGXG(U%D+!VFRIm`
"#L(CT"QJ!$MST`"3TAZQ!##!I%Q`TBR3I+2(BJ)!(CTb!01LEVaTC6,!SfFkT31
JTTQADd3&Th+UVlN+TY[!Urm!X1I*U,IQVS)!Vi$UCb)3I)4k!XQJVaKB%L,`+l4
`XGdU#Z`CUB3!GK!J"(pSUIRkJLDl0pbJFe0'$SjhC3`SS#Y+!#hU!rP31p*+"$*
+IR'j!CI$"QZ*A4Z!XKmDKaZ!X`pD%Nal+Q``$J"3N!#j#3!Rbc3TfkQh&J(''(6
0k'A,U)cJG`#,'3i2J!1F`CCJLl2RQD-%#ijEa`JP5)jK9l$Ub)+K"iI%C6PDHjl
X#JAjL(H8B%%L)!%!+!@FCj[3N!!!8(#Z*SZbjhN"6JN*$cPj*&##SJ#j`cPf"l#
F8$"iF-KL)Q#hH@TPq(#5"qF,SJZj#,"jb2HGi*!!!"4`HrePZ$V$"LTVC4(`Nm*
(#,8,!Zr*HIDTJU*AXQ#VZ3((XpBA$YNhM(#JYX"3S'fVS(%lYrY6YA($$9cVY8[
EY%q,Y9),Pe4VY3#BUm"V,F*,C6N`$dkjJ'Ye$PrfL%-,"k8+&2!!`&mEYLU6XV0
'"$UT#%$+DB%'!+,!GqK)9$AVJXlCZZ1,HJKFJ`Z!$0K$R3!J#"#-"&fE!(K3#BP
!")4VXNf,`543Ja+!!YL$"1e*!*2U[`$)RCD`D*JE[@+,`843Jb)!`p5'KJJ!GXB
M`J9`Vj6`K[YkXaGm`$r-EN+-#'KSI(iQRa,FR3PJVZAhZbXFF%2JP2P`$%pf#&m
Q!%@(!(!J`J2`"(K!$`mJF9mEY@)lPN#JSA3V[T(#$ACFPX59YF&VI`F!#NqfDDT
+a`9-$QQK!+rDa(9l`I4V[eB'$dI!!30JM)liCD+fJ!(K#!!3$Nl`,&fX`SGl`$U
*ML`,MU)VD')(K-8V!C%!LJ1XZDCFJkqjXHTCJS+JK[8D!*!!%!#`h!EiZ6m@[-F
XV*!!GML-!K!#8AJpB-B$LB!5%)"#(e!&i9Qi+`c&0FL%eCE,aX2,4qDH%5$-0FV
$"Hc$05LIN!#`c#5)!*!!S)BT@,`38,bX')I&r#mj#mC15FNqF-Rlk`22c-N!i!$
L,-Uj#XMbUhiIm!rpS,jL#hm!B!GBLl1#['N!J*Y(X3GBfl3JKJ!5e42HFK4pN!#
j28brm1#8Fd$'!ZU)N!!BCK%!IMq4![F`VDJ4d8jXc!FF!EejDarBSi''!#3iD)#
VJJ(`TSF+!"S0YYNmCd3!!6YYJe$+RJM`!!,JJa*!2!H3!!JjB05J#3!MEFj#BX"
-$3*2,AZN`'HFm"R)#faAhE9*8!6RF+5FBG12M00-$34PM3+q%!$S)!V%XkGX66a
*h!GF,49)6FV"Lm&iM@G#6*hZA)8[$!K*(!5&,G)NIFi""`3SVG+"H3!!(B%[hE9
2d!2dm!3jd085$3"kM-rPqf5'RG3)25*1qljHlG!&,-KDPh@'RGUVI5[F!0&*(Eq
bVE-jF0*@YJr[`!P"a`&GeR$-'0UQ5J"`qc&Vep"Jl5TL$AJklB&![A@LB$[dCSk
!qi6[+)4VC`mhMFmBl06F,3*i*`S"6),r+,Q!30i4B0irKXfP20C113r2X*j2`!P
r4VX8'3RTD0pDZ#Y!GYfHNYeUpY5#!03(jpFQf*+iqi4&F0me'3(m`,UZHpF3hYd
b,,Vj5J#4MH%DrQ-8KpMbUl-iS0RFRAe)!)N()!*c8*A3MCK`Q`FU6J#FKFKKEAm
pNAmR0p(M+q3'N!"r(h!!r4AEPF)'X$J!M%a85L%!j2EM++[)RPMPbHEKN!!XCIA
EhcmEQ%80CJ3`"j-B$4#JQ%!`F35JhiPGbi`0#J*JJJ0`MX$!!,)(J&%3Ve%!"'S
(!Bjff@'phQ1)!V``!-#*!!9!!I*'!4r)ja$3MS$1CPjZei"(ePBf$mH`RLq!NJP
!!Q"'!S*JD!'JjT6`"C@1C($HiJFF"#[,RL$`!!6Z!j(q-j2qji'qi!4Fk!FX",%
1JN"3e2*'`i`f!+LZkqHGhVlYiNG3STcqPmM!#IK3jN"`jL!dd'XH#Ac`G%bed9S
lPVN)J$CRff%pPQ$JF41!$bc@farbfh#*!(rFY+j+!,(k!0M9kpK0h*+F&X+Qh%r
!C6Jb!-4!",U)!-6miB#RK!B!GL')$!)!#$JL!%4!"JI[aIX0H""JG3d2!U#!G`)
!$c""m98!!IPheIP1braG,0+jCdp!!!J`mN63"#B2J1ZHm%r-e,$1m["fF(mQmbb
BIa!!#"JIjd`0l$`II%KJ2%!2!d)2##PIdM[hl-85"m+3!(e2J!K`!"-%6`63m26
KLl2e,SX3m!p0MVlN[Z"!lLUh3&-!J0kU66KZEf-rS&#HT"bUa&%rN!$hTJ3!G9p
!Yi6hGKmhpJ(iq16hJfp4IQriSZ6hI%p,L-ri+[-HMamTK9rjPF)IQ1mTP*rirh,
jRQmSQKrk'0,jN[mKS(rk@M,kULmRTVrj%*,kX%mLV$rlq[(kT2mNXTrlpe(l[*m
IZ0rkD,,h[lrkIPmS`QmTLfrl#(),ZjrmlC%Fb-rmrr%'bH%2e+mI[e!5a0(paH(
pi2rpiKrqj$rqjPrqk(rqkTrql,rqlYrqm2rqmKrrp$rrpPrrq(rrqTrrr,rrrYr
r!2$r#F!!5!!(S!%XJ!M`!#V!"-J!a4rKR`!!:

-----------------cut here-------------------------------------------

Well thats the file. I did find the WDEF on the floppy I suspected. It was
a floppy that I had used in the U of I Microcomputer Lab (basement of 
the student union) on a Mac II connected to an Apple Scanner. I had been
suspicious of the disk after I found out about the problem. Sure enough it
had the WDEF in the desktop just like my desktop on the harddrive of my
SE. I used ResEdit to remove it from the floppy and Vaccine asked me if
I wanted to add it to my system disk which I of course said no and it was
gone. On my hard drive I rebuilt the desktop to remove it. Any way all
weird font display symptoms are now gone on my SE once the WDEF was
removed.
 
Russ Jacobson
Illinois Geological Survey
Technical Details
Message-ID: <110300032@uxe.cso.uiuc.edu>
Path: arc1-ca.pugleaf.net!utzoo!utgpu!jarvis.csri.toronto.edu!rutgers!cs.utexas.edu!uwm.edu!ux1.cso.uiuc.edu!ux1.cso.uiuc.edu!uxe.cso.uiuc.edu!jacobson
References: <110300031@uxe.cso.uiuc.edu>

Show Full Headers
Complete Article Headers
Path: arc1-ca.pugleaf.net!utzoo!utgpu!jarvis.csri.toronto.edu!rutgers!cs.utexas.edu!uwm.edu!ux1.cso.uiuc.edu!ux1.cso.uiuc.edu!uxe.cso.uiuc.edu!jacobson
From: jacobson@uxe.cso.uiuc.edu
Newsgroups: comp.sys.mac
Subject: Re: WDEF "virus" & symptoms of presence
Message-ID: <110300032@uxe.cso.uiuc.edu>
Date: 10 Dec 89 10:40:07 GMT
References: <110300031@uxe.cso.uiuc.edu>
Lines: 143
Nf-ID: #R:uxe.cso.uiuc.edu:110300031:uxe.cso.uiuc.edu:110300032:000:8761
Nf-From: uxe.cso.uiuc.edu!jacobson    Dec  9 13:55:00 1989