Path: utzoo!attcan!utgpu!jarvis.csri.toronto.edu!cs.utexas.edu!rutgers!netnews.upenn.edu!vax1.cc.lehigh.edu!sei.cmu.edu!krvw
From: yale!slb-sdr!sdr.slb!shulman@uunet.UU.NET (Jeff Shulman)
Newsgroups: comp.virus
Subject: Re: WDEF Virus (Mac)
Message-ID: <0007.8912111157.AA07688@ge.sei.cmu.edu>
Date: 9 Dec 89 18:07:23 GMT
Sender: Virus Discussion List <VIRUS-L@IBM1.CC.Lehigh.EDU>
Lines: 50
Approved: krvw@sei.cmu.edu

C0195@UNIVSCVM.BITNET (Gregory E. Gilbert) writes:

>Recently there was a posting on VALERT-L about a new virues, WDEF.  In the
>alert it is mentioned that:

>(stuff deleted)

>"Jeff Shulman, the author of Virus Detective 3.1, recommends adding the
>following search string to detect the virus:

>CREATOR=ERIK & Resource WDEF & Any

>Virus Detective can also be used to remove the virus ......"

>Where or to what do we add the "following search string".  Please
>pardon my ignorance.

>Greg

These instructions only apply to VirusDetective 3.x

1. Select VirusDetective from the DA menu.
2. Click the Modify Search Strings button.
3. Type
	Creator=ERIK & Resource WDEF & Any ; For finding WDEF, etc.
4. Click the Add button.
5. Click the Save button.
6. That's it!

Specific instructions can be found both in the VD doc file, online
docs and is going to be mailed out to registered users early this
week.  I will also be posting a file full of the latest search strings
that you can read in by clicking Read from File instead of steps 3 &
4, and I will be posting VD 3.1a that has this string already built in
(NO code modifications were made).

If you are a registered user and you still need more assistance don't
hesitate to contact me either electronically or by phone.

Jeff Shulman
VirusDetective Author

As usual, this is *me* speaking and no other organization.

uucp:      ...rutgers!yale!slb-sdr!shulman
CSNet:     SHULMAN@SDR.SLB.COM
Delphi:    JEFFS
GEnie:     KILROY
CIS:       76136,667
AppleLink: KILROY