Path: utzoo!utgpu!news-server.csri.toronto.edu!cs.utexas.edu!uunet!brunix!doorknob!daf
From: daf@cs.brown.edu (David A. Fedor)
Newsgroups: comp.sys.mac.misc
Subject: Re: A possible new virus.
Message-ID: <DAF.90Aug22125530@betty.cs.brown.edu>
Date: 22 Aug 90 16:55:30 GMT
References: <60814@lanl.gov>
Sender: news@brunix.UUCP
Distribution: na
Organization: Department of Computer Science, Brown University
Lines: 38
In-reply-to: rbc@lanl.gov's message of 22 Aug 90 15:21:50 GMT

In article <60814@lanl.gov> rbc@lanl.gov (Robert B. Calhoun) writes:

   I suspect that my Mac II is infected with a new virus.  I have tried
   cleaning it with Virex 2.7, which removed a WDEF virus from the
   desktop but this fails to stop the problem.  Symptoms are as follows:
   Files disappear from the finder display, but don't actually seem to be
   gone.  I can't access them, but an attempt to copy a file with the
   same name as a deleted file gives a "duplicate file name" error.  No
   disk space has been freed up... Files seem to disappear in reverse 
   alphabetical order.

   ...It is as if files are deleted on a high level but still exist at a
   very low level so that the mac can still start itself.  (I can still
   print, without a Laserwriter file).

People! This is NOT a virus.  These are the classic symptoms of a
damaged catalog tree file.  Unfortunately, I do not know of any
programs which will fix this automatically.  I'm planning to write
such a beast, but not for a little while... things are too busy right now.  

I'm going to directly help Robert, through email or by phone, since I
do know how to manually fix this problem.  If anybody else has this
problem, feel free to mail me and I'll see what I can do.  

If this does happen to you... DON'T initialize the disk.  Your files are 
there, completely intact, so unless you've got a very recent backup of
your entire volume, it would probably be a waste of time.  As Robert noticed,
the mac can still function totally normally even when it can't find
the files to display them in a finder window.  The same thing will
happen if you lose an application this way - clicking on a datafile
will bring up your app just like normal.

Anyway... I hope very few people get this problem... if you do, let me know.
Of course, if someone would like to write the program, I'll be glad to supply
the technical information... :-)

-Dave Fedor
daf@cs.brown.edu or, on bitnet, daf@browncs