Path: utzoo!attcan!utgpu!jarvis.csri.toronto.edu!mailrus!shadooby!accuvax.nwu.edu!jln
From: jln@accuvax.nwu.edu (John Norstad)
Newsgroups: comp.sys.mac
Subject: Re: New virus? and other stuff
Message-ID: <787@accuvax.nwu.edu>
Date: 22 Jun 89 14:42:05 GMT
References: <2278@ur-cc.UUCP> <838@rex.cs.tulane.edu> <25127@shemp.CS.UCLA.EDU>
Sender: news@accuvax.nwu.edu
Reply-To: jln@accuvax.nwu.edu (John Norstad)
Distribution: na
Organization: Northwestern Univ. Evanston, Il.
Lines: 19

Some virus-fighting programs add a special nVIR 10 "inhibitor" resource to
the system file in an attempt to prevent future infections.  Interferon 
mistakenly thinks that this resource is an actual infection.  Disinfectant 
does not, and will not remove the resource when repairing the system file.
This is one possible explanation for why in your case Interferon thought
that
your system file was still infected after you repaired it with Disinfectant.

This is just a theory of course - it's impossible to say exactly what
happened in your case.  You did the right thing though - it's always safest
to delete infected files and replace them with known good copies.

Disinfectant does check itself on startup and notify the user if it has been
modified.  It does not, however, try to repair itself if it discovers a
change.

(I'm the author of Disinfectant)

John Norstad      Northwestern University      jln@acns.nwu.edu