Path: utzoo!attcan!utgpu!jarvis.csri.toronto.edu!cs.utexas.edu!samsung!think!kulla!ephraim
From: ephraim@kulla (Ephraim Vishniac)
Newsgroups: comp.sys.mac
Subject: Re: I'm not sure I believe this. (was Re: New WDEF Virus)
Message-ID: <32155@news.Think.COM>
Date: 13 Dec 89 17:16:36 GMT
References: <3277@hub.UUCP> <1501@rodan.acs.syr.edu> <4221@sbcs.sunysb.edu> <1042@sys.uea.ac.uk>
Sender: news@Think.COM
Reply-To: ephraim@think.com (Ephraim Vishniac)
Organization: Thinking Machines Corporation, Cambridge MA, USA
Lines: 17

In article <1042@sys.uea.ac.uk> jrk@uea-sys.UUCP (Richard Kennaway) writes:
>I havent seen the WDEF virus here, so cannot speculate on why GateKeeper
>would not stop it, nor on whether the virus might be just a badly chosen
>signature resource type.

A just did a quick tour of my own Desktop file, and found that the
Finder doesn't copy signature resources into it.  Instead, it creates
resources of the same type containing just six bytes of data.  Since
the virus is over six bytes long, I think we can rule this out as its
origin or original means of transmission.

I don't know what the six bytes of data are in each signature resource
in the Desktop.  Anybody have a guess?
Ephraim Vishniac    ephraim@think.com   ThinkingCorp@applelink.apple.com
 Thinking Machines Corporation / 245 First Street / Cambridge, MA 02142
        One of the flaws in the anarchic bopper society was
        the ease with which such crazed rumors could spread.