TOPIC
This article, part 2 of 2, discusses viruses along with how to detect and remove them.
DISCUSSION
Continued from Computer "Viruses" (1 of 2) KNOWN VIRUSES Hong Kong Virus (also known as Autostart Virus or Autostart Worm) This virus may affect the computer in a way that would look like a hard disk or logic board failure. Test the computer after starting up from a startup CD-ROM disc (since the virus cannot affect a CD-ROM). If the computer is functioning normally, run an anti-virus application that has been updated to detect and destroy this virus. Many public domain utilities are now available to detect this new virus. When I play audio tracks on enhanced CD (CD Plus or CD+) format CD-ROM discs, the music will stop playing when I access other applications from the Finder, or won't play at all. This does not happen with audio-only CDs. These symptoms can also occur with standard audio CD-ROM discs that are not multisession enhanced CDs if the Hong Kong Virus, aka Autostart Worm, has infected the computer's drives. Symptoms may include: A quick way to look for this virus, if you have System 7.5 or later, is to choose Find from the File menu while the Finder is active and follow these steps:
2. Click name and choose visibility from the pop-up menu. 3. Click More Choices. 4. Click contains and choose doesn't contain from the pop-up menu. 5. Type "icon" in the text field. 6. Click More Choices. 7. Click size and choose file type from the pop-up menu. 8. In the text field enter the file types listed below, for example, (APPL or appe). 9. Click Find. Look for invisible files with these names: Please be aware that as this virus spreads it can be "mutated" to change the file names of the hidden files. This virus attaches itself to any write enabled disk inserted in an affected computer and is activated by the Enable CD-ROM AutoPlay feature built into QuickTime. Deselecting the Enable CD-ROM AutoPlay checkbox in the QuickTime Settings control panel should stop the virus from spreading to other write enabled disks, however, this action does not remove the virus. When activated it creates an invisible extension that allows the virus to spread to other disks. The virus works slowly to corrupt data in the files on the hard disk, eventually destroying the files. It does not affect 680x0 computers since this virus is PowerPC processor code. For more information, use this URL: " http://www.macintouch.com/hkvirus.html " The Scores Virus You can be almost positive your system has been infected by the Scores virus if the icons of your Note Pad file and Scrapbook file look like document icons instead of system icons. Launch ResEdit and look in your System folder. If you see files called "Desktop" and "Scores" you can be 99% sure that you have the Scores virus. How Scores Spreads and What It Does The Scores virus is relatively harmless. The initial infection is caused by an application with a modified CODE ID = 0 resource, and an additional CODE resource (first unused ID number plus 1). When the 'carrier' application is launched, the CODE ID = 0 resource runs the virus installer code. This code checks for previous installation of the Scores virus. If the virus is not there, the virus files are installed. The virus consists of three INITs, one atpl, and one DATA resource found in the files listed below:
If the Note Pad and Scrapbook files do not exist, they are created. If they exist, the type and creator of the files are altered to those listed above, and the corresponding resources are added to the files. The files still appear to function normally with the Note Pad and Scrapbook DAs, but their icons change to document icons. The Desktop and Scores files are invisible, and are created during the infection process. The next time the infected system is rebooted, the INITs are loaded into memory and are ready to infect other applications. The INITs install a VBL task that actually modifies and installs resources into an application. After an application has been launched, an internal timer is started. Somewhere between two and three minutes later, the open application is infected and becomes a carrier. A new CODE resource is added to the infected application, and the application's CODE ID = 0 resource is modified to execute the new CODE resource first, then continues with the application. To determine if an application is infected, examine the CODE ID = 0 resource. If the eleventh word of the resource (third word on the third line in the ResEdit listing) is NOT "0001", the application is suspect. If the third word is something other than "0001", convert the value to its decimal equivalent (the numbers are in hexadecimal). Then determine the resource number of the CODE resource at the top of the ResEdit resource list. If these numbers are the same, the application is probably infected, and should be replaced. Some applications will appear to be infected even though they are not. If the eleventh word of CODE ID = 0 is not 1, check the tenth word; if it is '4EED' the application is most likely not infected. How to Get Rid of the Scores Virus It is not hard to remove this virus from a system, but it may take some time. Follow the stetps below:
2. Start the system from a locked, not infected, floppy disk. 3. Throw away the System folder on the infected disk. 4. Use ResEdit to identify all suspect applications on the infected disk. 5. Make a list of all suspect applications. 6. Throw all suspect applications in the trash, and empty the trash. 7. Reinstall the system software from a known good System Tools installer disk. 8. Using locked masters, recopy any applications that were deleted from the infected disk (it is important to verify that the master disks have not been infected). 9. You're all done. The nVIR Virus How the nVIR Virus Spreads and What It Does The nVIR virus is similar to the Scores virus in many ways. It does not appear to have malicious intent and is relatively harmless. Initial infection of a system is also caused by an application with a modified CODE ID = 0 resource. When a nVir carrier application is launched, the virus' code segment is executed first. This code checks for its INIT in the System File, and if it doesn't find it, the code copies the INIT there. Along with the INIT resource, eight 'nVIR' resources (0-7) are added to the System file. The next time the system is restarted, the INIT ID = 32 is loaded into memory and tries to infect every application that is launched. The nVir virus adds a CODE ID = 256 resource and modifies the CODE ID = 0 so that the nVir code is executed first. Again, infection of an application is determined by examination of the CODE ID = 0 resource. If the eleventh word of the resource (third word on the third line in the ResEdit listing) is NOT "0001", the application is suspect. If the third word is something other than "0001", convert the value to its decimal equivalent (the numbers are in hexadecimal). Then determine the resource number of the CODE resource at the top of the ResEdit resource list. If these numbers are the same, the application is probably infected, and should be replaced. Some applications will appear to be infected even though they are not. If the eleventh word of CODE ID = 0 is not 1, check the tenth word; if it is '4EED' the application is most likely not infected. The tenth word normally contains '3F3C'. When launching an infected application, there is a one in sixteen chance that you will hear a short system beep. We have been told that if MacinTalk is installed you will hear the words "don't panic". How to Get Rid of the nVIR Virus Remove the nVIR virus the same way you remove the Scores virus except you do not need to throw away all of the files in the System Folder; just throw away the System file. The MacMag Virus We don't have much information regarding the MacMag virus. It was apparently uploaded to CompuServe, inside a HyperCard stack, in the form of an XCMD, and it installed an INIT ID = 6 with a name of 'RR'. Its sole purpose in life was to display a "universal message of peace" on your computer on March 2, 1988. The virus removed itself after displaying this message and should be of little concern now. SAFEGUARDING YOUR SYSTEMS What Makes Our System Susceptible to Viruses The various mechanisms described in part 2 of this article make our system easy to infiltrate by a virus. Remember that it is those same mechanisms that add to the flexibility and "look and feel" of the Macintosh. For instance, the INIT mechanism is used by mail systems to load their code in. AppleShare uses the INIT mechanism to mount network volumes at boot time. Why Vaccine Works in This Case, But Is Easy to Bypass Vaccine, a public domain INIT written to block viruses, does a good job of alerting you when the three known viruses are trying to infect your system. The problem with Vaccine: once a cure is found for one set of viruses, a new strain may appear that knows how to bypass the existing defenses. Some Suggestions |
| Document Information | |
| Product Area: | Apple Software |
| Category: | Virus Detection Software & Information |
| Sub Category: | Computer Viruses |
Copyright © 2000 Apple Computer, Inc. All rights reserved.