🚀 go-pugleaf

$@0BC#!w2-EE5$$G(J$@$9!#(J

$@F|K\$N(JVirus Busters$@$N3'$5$s$X!#(J

$@:#!"(Jcomp.sys.mac.announce$@$r8+$F$$$?$i!"<!$N$h$&$J5-;v$r(J
$@8+$D$1(J$@$^$7$?!#$$$D$b$NBP=h$r$h$m$7$/$*4j$$CW$7$^$9!#(J
$@!J#3$D$N5-;v$r0zMQ$7$F$$$^$9!#D9$/$F$4$a$s$J$5$$!K(J

SAM 3.0$@$O!"BP:v$N(Jsearch string$@$r!"(JDisinfectant$@$O!"?7HG(J(2.7)$@$r%j%j!<%9$7$F$$$k$h$&$G$9!#(J
SAM 3.0$@$N%5!<%A(J$@%9%H%j%s%0$K$D$$$F$O!"#2HVL\$N5-;v$K4^$^$l$F$$$^$9!#(J

$@%S!<%k%9$N35MW$N$_!"MWLs$7$F$*$-$^$9!#(J

-- $@MWLs(J$@3+;O(J --
INIT 1984$@$H8F$P$l$k%S!<%k%9$O!"(JINIT$@$K$N$_4s@8$7$^$9!#(J
$@Ho32$O!"#1#9#9#1G/0J9_$N#1#3F|$N6bMKF|!J(J$@:#G/$G$O!"#37n!"#97n!"#1#27n$,3:Ev$7$^$9!K$K(J
$@%U%)%k%@!"%U%!%$%k$N%i%s%@%`$J%j%M!<%`!"!J$4$/5)$K!K:o=|(J$@$,$*$3$J$o$l$^$9!#(J

$@$?$@!"(JINIT$@$O$"$^$jIQHK$K;}$AJb$/$h$&$J$b$N$G$O$J$$$N$G!"46@wN($ODc$$$b$N$H;W$o$l$^(J$@$9!#(J

$@3F%S!<%k%9BP:v%=%U%H$O!"$9$G$K?7HG$NMQ0U$r;O$a$F$$$^$9!#(J
-- $@MWLs=*N;(J --


------ 1st article

		 New Macintosh Virus Discovered

Virus: INIT 1984
Damage: high
Spread: minimal
Systems affected: Apple Macintosh computers. All types. 

A new virus, which has been designated "INIT 1984", has been
discovered on Apple Macintosh computer systems. This virus is designed
to trigger if an infected system is booted on any Friday the 13th in
1991 or later years. Damage from the virus includes changing the names
and attributes of a large number of folders and files to random
strings (making it difficult to recover them) and complete deletion
of a few files.

The virus only infects system extensions of type "INIT" (also known as
"startup documents"). It does not infect the System file, desktop
files, control panel files, applications, or document files. Because
INIT files are shared less frequently than are applications, and
because of the structure of the virus code, the INIT 1984 virus does
not spread as rapidly as most other viruses.

As of the date of this announcement (3/19/92), we have only a few
reported sightings of this virus, including one from a site in Europe
and one from a site in the USA. In both cases, the virus caused
significant damage when infected Macintoshes were restarted on Friday,
3/13/92. Because only a few reports of damage were received, we have
reason to believe that the virus is not widespread. However, it is
conceivable that this virus might have affected Macintosh systems on
Friday 9/13/91 or Friday 12/13/91 without being recognized as the
cause of the damage.  If you think you may have been a victim of this
virus in 1991, please contact me via e-mail at spaf@cs.purdue.edu.


The current versions of Gatekeeper and SAM Intercept (in advanced and
custom mode) are effective against this virus.  Either program should
generate an alert if the virus is present and attempts to spread to
other files.

The virus affects all types of Macintosh computers. It spreads and
attacks under both System 6 and System 7. On very old Macintoshes
(those with the 64K ROMs), the virus will cause crashes at boot time.

Authors of all major Macintosh anti-virus tools are planning updates
to their tools to locate and/or eliminate this virus. Some of these
are listed below. We recommend that you obtain and run an updated
version of at least one of these programs.

Some specific information on updated Mac anti-virus products follows:

    Tool: Disinfectant
    Status: Free software (courtesy of Northwestern University and
		John Norstad)
    Revision to be released: 2.7
    Where to find: usual archive sites and bulletin boards --
	           ftp.acns.nwu.edu, sumex-aim.stanford.edu,
                   rascal.ics.utexas.edu, AppleLink, America Online,
                   CompuServe, Genie, Calvacom, MacNet, Delphi,
                   comp.binaries.mac
    When available: (expected) 3/20/92


    Tool: Gatekeeper
    Status: Free software (courtesy of Chris Johnson)
    Revision to be released: 1.2.5
    Where to find: usual archive sites and bulletin boards --
	           microlib.cc.utexas.edu, sumex-aim.stanford.edu,
                   rascal.ics.utexas.edu, comp.binaries.mac
    When available: (expected) 3/20/92


    Tool: Rival
    Status: Commercial software
    Revision to be released: INIT 1984 Vaccine
    Where to find it: AppleLink, America Online, Internet, Compuserve.
    When available: Immediately.


    Tool: SAM (Virus Clinic and Intercept)
    Status: Commercial software
    Revision to be released: 3.0.7
    Where to find: CompuServe, America Online, Applelink, Symantec's
                   Bulletin Board @ 408-973-9598
    When available: Immediately.  Version 3.0.7 of the Virus
                    Definitions file are also availble.


    Tool: Virex INIT
    Status: Commercial software
    Revision to be released: 3.7 
    Where to find: Microcom, Inc (919) 490-1277 
    When available: Immediately.
    Comments:
    Virex 3.7 will detect and repair the virus. All
    Virex subscribers will automatically be sent an update on
    diskette. All other registered users will receive a notice with
    information to update prior versions to be able to detect
    INIT-1984. This information is also available on Microcom's BBS.
    (919)419-1602, and is given below.

    Virus Name: INIT 1984    Guide Number: 5275840
    Virus Code: 0049  4E49  5410  07C0  96
		3008  1490  7710  002F  2C
		3C49  4E49  5400  0300  1E
		4AA9  AB55  4F81  8090  9A


    Tool: Virus Detective
    Status: Shareware
    Revision to be released: 5.0.3
    Where to find: Usual bulletin boards will announce a new search string.
                   Registered users will also get a mailing
  	           with the new search string.
    When available: Immediately.
    Comments: search string is
Resource INIT & Size<4500 & WData 494E#EA994*4954#8A9AB ; For finding INIT1984

----- 2nd article
As part of Symantec's commitment to virus protection, it is our responsibility
to inform you that a new Macintosh virus was recently discovered, called INIT
1984 which affects all Apple Macintosh computers systems.  This virus is
designed to trigger if an infected
system is booted on any Friday the 13th in 1991 or later years. Damage
from the virus includes changing the names and attributes of a large
number of folders and files to random strings, and the actual deletion
of a small percentage (<2%) of files.
 
The virus only infects system extensions of type "INIT" (also known as
"startup documents"). It does not infect the System file, desktop
files, control panel files, applications, or document files. Because
INIT files are shared less frequently than are applications, and
because of the structure of the virus code, the INIT 1984 virus does
not spread as rapidly as most other viruses.
 
The virus affects all types of Macintosh computers. It spreads and
attacks under both System 6 and System 7.
 
Owners of SAM(tm) Version 3.0 can instantly update the detection and protection
capabilities of the program against this new virus by entering the new virus
definition into SAM Virus Clinic.  In conjunction with the new "SAM User
Definition" and SAM 3.0, you will be able to scan for INIT 1984 from both Virus
Clinic and SAM Intercept.
 
UPDATE DETECTION INSTRUCTIONS
 
Open SAM Virus Clinic.  From the Options menu select "Advanced Menus".  Select
"Add Definition (Resource) from the Definitions menu.  Now enter the following
information:
 
Virus Name:INIT 1984
Resource Type: INIT
Resource ID:   ANY O
Resource Size: = 4342
Search String: HEX A9AB554FA9AF3E1F2F2EFE5AA9AA554F
   (no spaces)
String Offset: =   4150   FROM START
 
NOTE:  O = zero
 
Please type in the search descriptions without any spaces.  As a guard against
incorrect entry, SAM 3.0 has a "Check" field in the definition screen.  If the
above information is entered correctly, your check field should be:  4A7E
 
After you've entered the above information, click "Add" to add  the definition
to SAM.  This information should be added to the SAM User Definitions File
located in your System Folder.
 
UPDATE REPAIR INSTRUCTIONS
 
Remember that entering the above user definition into SAM Virus Clinic only
updates the detection capabilities of SAM.  For repair capabilities, users can
download the virus definitions file (available MARCH 14, 1992)  from the
Symantec Bulletin board at (408) 973-9598, CompuServe, America Online or
Applelink.
 
If you don't own a modem and cannot download the virus definitions file, you
can receive a disk with repair capabilities for $12.00 (plus sales tax where
applicable).  To order, please call Customer Service at (800) 441-7234 in the
US and in Canada.
 
--- 3rd article
Disinfectant 2.7

	[ available NOW for FTP from site FTP.ACNS.NWU.EDU in binhex
	  and from RASCAL.ICS.UTEXAS.EDU in mac/NEW in binary format ]

March 23, 1992

Disinfectant 2.7 is a new release of our free Macintosh anti-viral 
utility.

Version 2.7 detects the new INIT 1984 virus. 

The INIT 1984 virus was discovered in the Netherlands and in several 
locations in the USA in March, 1992.

INIT 1984 is a malicious virus. It is designed to trigger if an infected 
system is restarted on any Friday the 13th in 1991 or later years. The 
virus damages a large number of folders and files. File and folder names 
are changed to random 1-8 character strings. File creators and file types 
are changed to random 4 character strings. This changes the icons 
associated with the files and destroys the relationships between programs 
and their documents. Creation and modification dates are changed to 
Jan. 1, 1904. In addition, the virus can delete a small percentage (<2%) 
of files.

The virus caused significant damage to the hard drives of several users 
on Friday, March 13, 1992. Because only a relatively small number of 
reports of damage were received, we hope that the virus is not widespread.

The virus only infects INITs (also known as startup documents or system 
extensions). It does not infect the System file, desktop files, control 
panel files, applications, or document files. Because INIT files are 
shared less frequently than are programs, the INIT 1984 virus does not 
spread as rapidly as most other viruses.

The virus spreads from INIT to INIT at startup time.

The virus affects all types of Macintoshes. It spreads and causes damage 
under both System 6 and System 7. On very old Macintoshes (the Mac 128K, 
512K, and XL), the virus will cause a crash at startup.

If you have an INIT file which is infected by the INIT 1984 virus, when 
the virus attacks during startup, the Disinfectant 2.7 INIT beeps ten 
times, and an alert is presented at the end of the startup sequence. The 
virus is neutralized and does not spread or cause any damage, but the 
non-viral part of the infected INIT runs as usual.

In order to properly detect and block the INIT 1984 virus, we had to make 
an important change to the way the Disinfectant protection INIT works. 

In previous versions of Disinfectant, the protection INIT always had to 
load last. Under System 7, the protection INIT had to be located in the 
System folder proper, not in the Extensions folder.

These rules have been turned upside down in version 2.7.

Starting with version 2.7, the protection INIT now must load first, before 
any other INITs. Under System 7, the protection INIT must be located in 
the Extensions folder, not in the System folder proper.

The "Install Protection INIT" command in version 2.7 installs the new 
protection INIT in the proper location. 

When version 2.7 is run, it checks to see if an older version of the 
protection INIT has been installed in either the System folder or the 
Extensions folder. If it locates such an older version, it presents an 
alert asking if you want to install the new version. If you click on the 
"Install" button, the old version is removed and the new version is 
installed.

In previous versions, several users reported "Unexpected error -194" 
errors when trying to install or save the protection INIT. We were finally 
able to reproduce this problem and find its cause. Version 2.7 fixes the 
error.

Many users have had problems trying to build a System 6 Virus Tools disks 
because they could not fit System, Finder, and Disinfectant on a single 
800K floppy. We now recommend building this disk without a copy of Finder 
and making Disinfectant the startup program. This should solve the problem.

We have added a new "Known Problems" section to the document. This section 
lists in one location all of the known problems with Disinfectant and all 
of the known incompatibilities between Disinfectant and other software.

Disinfectant 2.7 is available now via anonymous FTP from site 
ftp.acns.nwu.edu [129.105.113.52].  It will also be available soon on 
sumex-aim.stanford.edu, rascal.ics.utexas.edu, comp.binaries.mac, 
America Online, CompuServe, GEnie, Delphi, BIX, MacNet, Calvacom, 
AppleLink, and other popular sources of free and shareware software.

Macintosh users who do not have access to electronic sources of free and 
shareware software may obtain a copy of Disinfectant by sending a self-
addressed stamped envelope and an 800K floppy disk to the author at the 
address given below. People outside the US may send an international postal 
reply coupon instead of US stamps (available from any post office). Please 
use sturdy envelopes, preferably cardboard disk mailers.

People in Western Europe may obtain a copy of the latest version of 
Disinfectant by sending a self-addressed disk mailer and an 800K floppy 
disk to macclub benelux. Stamps are not required. The address is:

   macclub benelux
   Disinfectant Update
   Wirtzfeld Valley 140
   B-4761 Bullingen Belgium

John Norstad
Academic Computing and Network Services
Northwestern University
2129 Sheridan Road
Evanston, IL 60208 USA

Internet: j-norstad@nwu.edu
-- end
			$@0BC#(J  $@=_!w2-EE5$(J(adachi@cs3.cs.oki.co.jp)