Path: utzoo!attcan!telly!lethe!torsqnt!jarvis.csri.toronto.edu!mailrus!tut.cis.ohio-state.edu!ucbvax!CIE.UOREGON.EDU!nparker From: nparker@CIE.UOREGON.EDU Newsgroups: comp.sys.apple Subject: Re: Viruses Message-ID: <8909230054.AA09977@cie.uoregon.edu> Date: 23 Sep 89 00:54:38 GMT Sender: daemon@ucbvax.BERKELEY.EDU Lines: 50 In article <4152@wpi.wpi.edu>, greyelf@wpi.wpi.edu (Micheal J Pender) writes: :In article <8909151534.aa10599@SMOKE.BRL.MIL> ST802148@BROWNVM.BITNET (Evan) writes: :>Have any of you encountered an Apple II virus where upon each boot of Prodos, t :>he computer scans available volumes (obviously to spread them), and then boots :>fine UNTIL one day when prodos doesn't show up on your hard drive - intead a gr :>aphics screen with some skulls and crossbones followed by a text screen of how :>everything on the drive has been anniliated and was the work of some sadistic h :>ackers? :I really feel terrible saying this now instead of earlier, but there is a :new virus out there that only seems to be on the GS so far. Its called :Lode Runner. I read up on it, and while the programs supplied work fine :to check your GS disks, the virus can apparently also hit our II :machines, and the detector won't run on anything but a IIgs. Sorry...as I said in a previous posting, these are NOT the symtoms of LOAD RUNNER. I have made a complete disassembly of LOAD RUNNER, and I assure you, there are no graphics screens in the virus, nor does it scan the drives. The reason that LOAD RUNNER has only been seen on the GS is that its code is GS-specific. It contains instructions that only execute on the 65816, and it makes GS toolbox calls. Booting an infected disk on any other Apple will NOT infect the Apple--instead, it would probably crash spectacularly. (I haven't actually seen this happen, but I can guarantee that LOAD RUNNER won't work on anything but a GS.) :I wrote a detector program, but never got arounnd to uploading it to :apple2-l. :I think I'll go do that now... A good idea anyway--anything done to help eliminate the threat of LOAD RUNNER can't be all bad... (All things considered, however, LOAD RUNNER isn't that much of a threat--it doesn't kill any data; it just makes disks unbootable.) Has anybody else out there seen the described virus? Is this a return appear- ance of an old virus, or have we got a new one to worry about? :Michael J Pender Jr Box 1942 c/o W.P.I. I wrote SHELL and Daemon, :greyelf@wpi.bitnet 100 Institute Rd. send bug reports, suggestions, :greyelf@wpi.wpi.edu Worcester, Ma 01609 checks to me. Neil Parker | nparker@cie.uoregon.edu (if that bounces, try 1810 Harris, #123 | PARKER@astro.uoregon.edu) Eugene, OR 97403-1334 |----------------------------------------------- (address subject to change) | (insert witty quotation here)