Path: utzoo!attcan!utgpu!jarvis.csri.toronto.edu!mailrus!csd4.milw.wisc.edu!cs.utexas.edu!usc!polyslo!vlsi3b15!vax1.cc.lehigh.edu!sei.cmu.edu!krvw From: XRJDM@SCFVM.GSFC.NASA.GOV (Joe McMahon) Newsgroups: comp.virus Subject: Re: nVIR and AppleTalk (Mac) Message-ID: <0010.y8907121814.AA00631@ge.sei.cmu.edu> Date: 5 Jul 89 13:41:33 GMT Sender: Virus Discussion List Lines: 26 Approved: krvw@sei.cmu.edu E. C. Greer asks: >Subject: nVIR and Appletalk (Mac) > >We've found a few MAC's here with nVIR (both A and B), and we're >having some success in dealing with the infections using SAM. So far >the affected machines appear to be isolated cases, but I'm concerned >becaues most of our 100+ MAC's are networked with Appletalk. Can >anyone tell me whether nVIR can be spread over Appletalk? If so, under >what conditions is it spread, and what countermeasures can I take? nVIR can transmit to a new machine in two ways: 1) The user runs an infected program on the machine, which installs the virus in the System file. After the "incubation period", the infected System file begins to spread the virus to applications run on the machine. 2) The user boots an infected System of his or her own and then runs applications which reside on the machine. This can infect appli- cations even if the "normal" folder on the machine contains a virus blocker like Vaccine. If your AppleTalk network only is used for mail or access to LaserWriters, you shouldn't have a problem. If you have AppleShare servers, make sure the servers are protected. You may have to disinfect the odd machine here and there, but the servers should be safe. --- Joe M.