Path: utzoo!attcan!utgpu!jarvis.csri.toronto.edu!mailrus!cs.utexas.edu!uunet!mcsun!unido!ztivax!tumuc!lan!zimmerma
From: zimmerma@lan.informatik.tu-muenchen.dbp.de (Kai Zimmermann)
Newsgroups: comp.sys.mac
Subject: Questions about nVIR
Keywords: nvir virus infect
Message-ID: <827@tuminfo1.lan.informatik.tu-muenchen.dbp.de>
Date: 4 Oct 89 13:15:18 GMT
References: <3797@deimos.cis.ksu.edu>
Sender: news@lan.informatik.tu-muenchen.dbp.de
Reply-To: zimmerma@lan.informatik.tu-muenchen.dbp.de (Kai Zimmermann)
Organization: Inst. fuer Informatik, TU Muenchen, W. Germany
Lines: 26

Hello,
Interferon detected the following resources in one program on my
harddisk one day after I copied some files from a floppy onto the harddisk:
Type	ID	Size
CODE	256	422
nVIR	1 	428
nVIR	2	8
nVir	3	416
nVIR	6	66
nVIR	7	2106
I then removed these resources instantly. What surprises me is
the fact that the infected application was used after it was
infected. But it seems that the virus didn't spread because 
neither Interferon nor I can find any nVir-resources on the disk.
My questions are:
1. Is this behavior common (e.g. is there a threshold (time, nr. of
program starts) that prevented the virus from spreading)?
2. Did the virus really not spread or did it just hide itself (maybe
in the normal code resources of other programs)?

Any help would be appreciated, Kai

=========================================================================
|   Kai Zimmermann      zimmerma@lan.informatik.tu-muenchen.dbp.de	|
|                       ...!uunet!unido!tumult!zimmerma                 |
=========================================================================