Path: utzoo!utgpu!news-server.csri.toronto.edu!clyde.concordia.ca!uunet!tut.cis.ohio-state.edu!pt.cs.cmu.edu!andrew.cmu.edu!hf07+ From: hf07+@andrew.cmu.edu (Howard Haruo Fukuda) Newsgroups: comp.sys.mac Subject: Re: Disinfectant 1.6 oddity Message-ID: Date: 24 Mar 90 17:47:11 GMT References: <46474.260AC8B9@cmhgate.FIDONET.ORG> Organization: Class of '90, Carnegie Mellon, Pittsburgh, PA Lines: 13 In-Reply-To: <46474.260AC8B9@cmhgate.FIDONET.ORG> Do not panic. 'fuck' is an nVIR clone that Disinfectant 1.6 catches and removes. Because you used SUM Tools to look at the resource fork instead of a resource editor like ResEdit, you did not see what resource the string 'fuck' was in. A 'fuck' resource would mean a 'fuck' infection, I spotted it in a 'VDEF' resource. I don't know exactly, but 'VDEF' seems to be where John put information about what resources to look at to spot a virus infection ('VDEF'<=>Virus DEFinition). What you spotted was just the instructions on how to remove the virus. -Howard Internet: hf07+@andrew.cmu.edu