Path: utzoo!utgpu!watmath!iuvax!mailrus!husc6!endor!siegel
From: siegel@endor.harvard.edu (Rich Siegel)
Newsgroups: comp.sys.mac
Subject: Re: Questions about nVIR
Keywords: nvir virus infect
Message-ID: <2795@husc6.harvard.edu>
Date: 7 Oct 89 21:12:38 GMT
References: <3797@deimos.cis.ksu.edu> <827@tuminfo1.lan.informatik.tu-muenchen.dbp.de>
Reply-To: siegel@endor.UUCP (Rich Siegel)
Organization: Symantec Language Products Group
Lines: 31

In article <827@tuminfo1.lan.informatik.tu-muenchen.dbp.de> zimmerma@lan.informatik.tu-muenchen.dbp.de (Kai Zimmermann) writes:

>I then removed these resources instantly. What surprises me is
>the fact that the infected application was used after it was
>infected. But it seems that the virus didn't spread because 
>neither Interferon nor I can find any nVir-resources on the disk.
>My questions are:
>1. Is this behavior common (e.g. is there a threshold (time, nr. of
>program starts) that prevented the virus from spreading)?
>2. Did the virus really not spread or did it just hide itself (maybe
>in the normal code resources of other programs)?

	It turns out that programs written using THINK C are incapable
of *spreading* nVIR (and possibly others). They can be infected, but
they don't seem to pass the infection along to other programs.

R.



~~~~~~~~~~~~~~~
 Rich Siegel
 Staff Software Developer
 Symantec Corporation, Language Products Group
 Internet: siegel@endor.harvard.edu
 UUCP: ..harvard!endor!siegel

"There is no personal problem which cannot be solved by sufficient
application of high explosives."

~~~~~~~~~~~~~~~