Path: utzoo!attcan!utgpu!jarvis.csri.toronto.edu!cs.utexas.edu!tut.cis.ohio-state.edu!purdue!mentor.cc.purdue.edu!mace.cc.purdue.edu!ajq
From: ajq@mace.cc.purdue.edu (John O'Malley)
Newsgroups: comp.sys.mac
Subject: More fuel to the WDEF virus fire
Message-ID: <3676@mace.cc.purdue.edu>
Date: 8 Dec 89 18:13:13 GMT
References: <12044@phoenix.Princeton.EDU> <3270@hub.UUCP>
Reply-To: ajq@mace.cc.purdue.edu (John O'Malley)
Organization: Purdue University Computing Center
Lines: 47

In article <3270@hub.UUCP> 6600pete@hub.UUCP (Pete Gontier) writes:
> In article <1886@accuvax.nwu.edu> jln@accuvax.nwu.edu (John Norstad) writes:
>>The WDEF virus infects the invisible "Desktop" files used by the
>>Finder.
>
>Now think about this: a WDEF can do anything it damn well pleases; it can 
>write a file or draw a window or both.

It's doubtful, but I may have discovered a symptom of the WDEF virus.

A few days ago I posted a note describing a problem I had on my Mac II
with font sizes not showing up in the appropriate menu typeface.  (Even
installed font sizes showed up in Chicago 12 plain on pull-down menus
of some programs when in MultiFinder.)

Skeptical about Eradicator!, I downloaded it and installed it on my
Mac II.  Sure enough, it beeped three times after the Mac was restarted.

But now my font size menu problem seems to have gone away.  Font sizes now
appear on menus correctly (in Chicago 12 plain when uninstalled, outline
when installed).

Not being a programmer, I don't know if my problem could have been related
in any way to the Desktop file.  But the problem went away immediately
after I installed Eradicator!.  Comments?

> Programmers crawl the Desktop file all the time.  WDEF's do NOT belong
> there.

My officemate has a Mac SE, and even though we're networked, we share
floppies often.  Eradicator! reportedly bombs on 68000s, so I instead
looked in his Desktop file with ResEdit.  It *did* have a "WDEF = 0"
resource.  He didn't have any font menu problems.  Once the Desktop was
rebuilt, WDEF was gone.

>Norstad tells me in mail he's already got a fix in Disinfectant 1.4 for this
>thing.

So what should people do who manage both Mac SE labs and Mac II labs?  Put
Eradicator! on only the II's?  We have a Mac dedicated to virus-checking
in our II lab (a public lab), but that Mac is, unfortunately, an SE.
Should I just wait for Disinfectant 1.4?

-John
---
John O'Malley           / Macintosh  / Purdue University / (317)
ajq@mace.cc.purdue.edu / Specialist / Computing Center  / 494-1787