Path: utzoo!utgpu!jarvis.csri.toronto.edu!mailrus!tut.cis.ohio-state.edu!ucbvax!ucsd!sdcc6!sdacs!wade
From: wade@sdacs.ucsd.EDU (Wade Blomgren)
Newsgroups: comp.sys.mac
Subject: Re: New virus?  No.
Summary: NOT A VIRUS !!!!!!
Message-ID: <99@sdacs.ucsd.EDU>
Date: 15 Jun 89 19:19:49 GMT
References: <2278@ur-cc.UUCP>
Distribution: na
Organization: UCSD Academic Computing Services
Lines: 22

In article <2278@ur-cc.UUCP>, jap2_ss@uhura.cc.rochester.edu (Joseph Poutre) writes:
> I may have run into a new virus.  When running Interferon 3.1 on our 
> harddrive and asking it to report anomalies it detected a type 003
> anomaly, the Sneak virus, in the Finder and the DA Handler.  While it did


Interferon 3.1 has known bugs.  In particular, it reports so called
"anomalies" with the wrong "number".  A "Type 103 (003 ?) Anomaly"
is not really a detection of Sneak.  The key is the word "anomaly" -
note that it is used in conjunction with result numbers 201-205 in the 
on line documentation.  What you have "run into" is a misreported
type 203 anomaly, namely "CODE resource in non-APPL file".  The Finder,
DA-Handler, and a number of other programs contain legitimate CODE
resources.  No virus.

For your future scanning and disinfecting needs, my recommendation is 
that you obtain a copy of Disinfectant 1.1 by John Norstad.  It is far 
more robust and complete than Interferon 3.1, and is available for 
free from a variety of sources.

Wade Blomgren
wade@sdacs.ucsd.edu