Path: utzoo!utgpu!news-server.csri.toronto.edu!cs.utexas.edu!uunet!midway!ellis.uchicago.edu!dwal
From: dwal@ellis.uchicago.edu (David Walton)
Newsgroups: comp.sys.mac.misc,lanl.mac
Subject: Re: A possible new virus.
Keywords: mac virus Virex 2.7
Message-ID: <1990Aug22.190238.15711@midway.uchicago.edu>
Date: 22 Aug 90 19:02:38 GMT
References: <60814@lanl.gov>
Sender: news@midway.uchicago.edu (News Administrator)
Organization: U. Chicago Computing Organizations, Academic and Public Comp.
Lines: 56

In article <60814@lanl.gov> rbc@lanl.gov (Robert B. Calhoun) writes:
>I suspect that my Mac II is infected with a new virus.  I have tried

[Various descriptions of files missing and such]

>Although the system file and finder are gone, the computer boots ok.
>It is as if files are deleted on a high level but still exist at a
>very low level so that the mac can still start itself.  (I can still
>print, without a Laserwriter file).

As a rule of thumb, don't point the finger at viruses (especially un-
discovered ones) until you've exhausted other possibilities; most 
problems are caused by other things.

In your case, I'd say check to see if your missing files are
invisible.  If you can't find System/Finder on your disk and you're
still able to boot from it, there's probably an invisible copy of them
lying around, or a visible copy buried deep in your directory tree
somewhere.  To find invisible files, you can use a utility like SUM
II, ResEdit, or FEdit+, all of which will allow you to reset the
file's information to make it visible again (mail me if you don't know
how).  If you don't have these utilities, you can at least see if they
are out there by using Microsoft Word 4.0's "Open any file" command
(shift-Open), which will display files of all types in the open dialog
box.  If you don't have Word, then I'm sure there are other utilities
for doing this (suggestions, anyone?).  And, of course, you can find a
lost System/Finder (one buried in a subfolder somewhere) by using Find
File.

You may also want to try just rebuilding your desktop file and see if
that recovers the missing files.  Do this by restarting your machine
and holding down the command and option keys until you get an alert
asking you if you "really want to rebuild the desktop on <insert disk
name here>."  You'll get this for each volume that's mounted at
startup; you'll only want to click OK for your boot disk.

Finally, I suggest that you get a copy of Disinfectant 2.1 and scan
your disks for viruses.  I don't know how effective Virex is, but I do
know that Disinfectant is one of the best (in my mind, _the_ best)
detection/removal program for known viruses.  John Norstand just
released version 2.1 a few days ago, so it's possible that you have
one of the new viruses that the update was designed to catch.

I can't think of anything else to try off the cuff; your symptoms are
admittedly rather wierd.  I'm sure that others in this group will have
other suggestions.  And of course, it is possible that your problems
are in fact caused by a virus, so you should clearly take whatever
measures you can to guard against further infections, and to root out
any you may already have.



--
David Walton            Internet: dwal@midway.uchicago.edu
University of Chicago   {  Any opinions found herein are mine, not  }
Computing Organizations {  those of my employers (or anybody else). }