McAfee > Theat Center > Virus Detail Page

Overview

This is a virus detection. Viruses are programs that self-replicate recursively, meaning that infected systems spread the virus to other systems, which then propagate the virus further. While many viruses contain a destructive payload, it's quite common for viruses to do nothing more than spread from one system to another.

Characteristics

This virus only affects desktop items on Apple Macintosh computers running System 4.1 and higher but does not work under System 7 and higher.

The virus intercepts 'Write', 'AddResource', 'ChangedResource', 'WriteResource', 'UpdateResFile' OS traps (during infection only).

Symptoms

Additional WDEF 0 resource in Desktop file - Desktop shouldn't have one. Virus beeps once if an infected application is run.

When running under MutliFinder if the first launched application has a menu that displays font-size information using the system, available font sizes are no longer displayed outlined - all sizes are displayed in normal style. Switching between applications does not change the first application's behavior.

Can cause system crashes and disk damage.

Method of Infection

The infection spreads after executing an infected Desktop file. The virus uses random algorithm and the availability of SysEnvirons-Trap (so no infection of systems without SysEnvirons). The random value is calculated using the RandomSeed system variable.

The virus copies itself to all desktop files on all connected volumes. Variant .b beeps every time it infects a new desktop file.

Removal

Please use the latest updates of Virex for cleaning. If this threat is detected on a Macintosh please use Virex to repair it.

If the infected object was found on a non-Apple file server it can be cleaned using Virex from a Macintosh client.

Infected Emails (usually in BinHex format) will be currently either deleted or quarantined depending on the configuration of mail scanner. Quarantined mails should be transferred to a Macintosh and cleaned using Virex.

Variants

Variants

N/A

All Information

Overview -

This is a virus detection. Viruses are programs that self-replicate recursively, meaning that infected systems spread the virus to other systems, which then propagate the virus further. While many viruses contain a destructive payload, it's quite common for viruses to do nothing more than spread from one system to another.

Characteristics

Characteristics -

This virus only affects desktop items on Apple Macintosh computers running System 4.1 and higher but does not work under System 7 and higher.

The virus intercepts 'Write', 'AddResource', 'ChangedResource', 'WriteResource', 'UpdateResFile' OS traps (during infection only).

Symptoms

Symptoms -

Additional WDEF 0 resource in Desktop file - Desktop shouldn't have one. Virus beeps once if an infected application is run.

When running under MutliFinder if the first launched application has a menu that displays font-size information using the system, available font sizes are no longer displayed outlined - all sizes are displayed in normal style. Switching between applications does not change the first application's behavior.

Can cause system crashes and disk damage.

Method of Infection

Method of Infection -

The infection spreads after executing an infected Desktop file. The virus uses random algorithm and the availability of SysEnvirons-Trap (so no infection of systems without SysEnvirons). The random value is calculated using the RandomSeed system variable.

The virus copies itself to all desktop files on all connected volumes. Variant .b beeps every time it infects a new desktop file.

Removal -

Removal -

Please use the latest updates of Virex for cleaning. If this threat is detected on a Macintosh please use Virex to repair it.

If the infected object was found on a non-Apple file server it can be cleaned using Virex from a Macintosh client.

Infected Emails (usually in BinHex format) will be currently either deleted or quarantined depending on the configuration of mail scanner. Quarantined mails should be transferred to a Macintosh and cleaned using Virex.

Variants

Variants -

N/A