Path: utzoo!attcan!utgpu!jarvis.csri.toronto.edu!mailrus!wuarchive!usc!apple!coherent!dplatt
From: dplatt@coherent.com (Dave Platt)
Newsgroups: comp.sys.mac
Subject: Re: More fuel to the WDEF virus fire
Message-ID: <41538@improper.coherent.com>
Date: 9 Dec 89 06:14:31 GMT
References: <12044@phoenix.Princeton.EDU> <3270@hub.UUCP> <3676@mace.cc.purdue.edu>
Reply-To: dplatt@coherent.com (Dave Platt)
Organization: Coherent Thought Inc., Palo Alto CA
Lines: 52

In article <3676@mace.cc.purdue.edu> ajq@mace.cc.purdue.edu (John O'Malley) writes:
> It's doubtful, but I may have discovered a symptom of the WDEF virus.
> 
> A few days ago I posted a note describing a problem I had on my Mac II
> with font sizes not showing up in the appropriate menu typeface.  (Even
> installed font sizes showed up in Chicago 12 plain on pull-down menus
> of some programs when in MultiFinder.)
> 
> Skeptical about Eradicator!, I downloaded it and installed it on my
> Mac II.  Sure enough, it beeped three times after the Mac was restarted.
> 
> But now my font size menu problem seems to have gone away.  Font sizes now
> appear on menus correctly (in Chicago 12 plain when uninstalled, outline
> when installed).

This might very well be related to WDEF.  We don't yet understand all of
its effects; some of them may be rather chaotic.  The commonest symptom
of WDEF infection seems to be crashes during "Save" operations.

> So what should people do who manage both Mac SE labs and Mac II labs?  Put
> Eradicator! on only the II's?  We have a Mac dedicated to virus-checking
> in our II lab (a public lab), but that Mac is, unfortunately, an SE.
> Should I just wait for Disinfectant 1.4?

In the short term, you can disinfect your SEs' hard disks by using
VirusDetective with the added search-string that Jeff Shulman has
recommended (Creator=ERIK & Resource WDEF & Any).  Run VirusDetective
under an application _other_ than the Finder, and leave it in the
"Disinfect floppies when inserted" mode... and ensure that your users
run their diskettes through before inserting them into any other SE.
[And, of course, cut a P/O for the shareware fee if you haven't done so
already... Jeff does good work and deserves support].

You can certainly wait for Disinfectant 1.4, if you prefer.  However,
I'd recommend that you clean up ASAP... don't wait unless you absolutely
must.  There's reason to believe that the WDEF virus causes crashes
during Save operations in a number of popular applications... and this is
a really lousy thing to have occurring during the last week or two of
the fall academic quarter, when so many term papers must be finished and
printed.

A new version of Eradicator! may appear in the near future... one which
would run correctly on an SE or Plus.  If one is released, I'm sure it
will be posted to comp.sys.mac or comp.binaries.mac quite quickly.



-- 
Dave Platt                                             VOICE: (415) 493-8805
  UUCP: ...!{ames,apple,uunet}!coherent!dplatt   DOMAIN: dplatt@coherent.com
  INTERNET:       coherent!dplatt@ames.arpa,  ...@uunet.uu.net 
  USNAIL: Coherent Thought Inc.  3350 West Bayshore #205  Palo Alto CA 94303