Path: utzoo!attcan!utgpu!jarvis.csri.toronto.edu!mailrus!wuarchive!gem.mps.ohio-state.edu!usc!polyslo!vlsi3b15!vax1.cc.lehigh.edu!sei.cmu.edu!krvw From: d9bertil@dtek.chalmers.se (Bertil Jonell) Newsgroups: comp.virus Subject: New Mac Virus Not In 'Moria' But in SuperClock3.5! Message-ID: <0009.8910062006.AA22699@ge.sei.cmu.edu> Date: 6 Oct 89 07:51:08 GMT Sender: Virus Discussion List Lines: 25 Approved: krvw@sei.cmu.edu Today when I had time to check the various downloads that had been occuring during the last few days I found that the recource STR ID 801 appeared in the document Clock Doc (a word document). I double checked this by extracting it from the .sit archive again and examinig it directly (On Cue from StuffIt to ResEdit). Since Stuffit and Resedit seems to be clean from this and othe known viruses I can only assume that the virus was there when Clock Doc was packaged! What I'm wondering now is: Is it confirmed that the STR ID 801 really *is* a sign of a virus? Is there any chance that it is a legitimate resource? (I've tested making new MacWrite documents with a locked copy, They have resources this 'International Resource' and a STR resource ID 701, None of them have had a STR ID 801) Clock Doc comes with the SuperClock! 3.5 INIT Recently posted to the comp.binaries.mac newsgroup. I'm sorry for causing constenation by proclaming Moria as a possible source, (Frankly, That .sit archive had been deleted so I couldn't check it, But since the known infected machines both had Superclock 3.5 installed within the last few days, Moria hav dropped off the list of prime suspects) - -bertil- Bertil K K Jonell @ Chalmers University of Technology, Gothenburg NET: d9bertil@dtek.chalmers.se VOICE: +46 31 723971 / +46 300 61004 "Don`t worry,I`ve got Pilot-7" SNAILMAIL: Box 154,S-43900 Onsala,SWEDEN (Famous last words) "GOOD DEEL ON SLIGHTLY USED CRANE" - Orson Scott Card 'The Abyss'