Path: utzoo!utgpu!news-server.csri.toronto.edu!cs.utexas.edu!wuarchive!usc!rutgers!netnews.upenn.edu!vax1.cc.lehigh.edu!cert.sei.cmu.edu!krvw
From: 76476.337@compuserve.com (Robert McClenon)
Newsgroups: comp.virus
Subject: a Macintosh WORM???!!! (Mac)
Message-ID: <0010.9012041821.AA14135@ubu.cert.sei.cmu.edu>
Date: 3 Dec 90 14:37:33 GMT
Sender: Virus Discussion List <VIRUS-L@LEHIIBM1>
Lines: 31
Approved: krvw@sei.cmu.edu

> We have a student who claims that Vaccine is reporting a "DCD WORM"
> infestation

> I have never heard of a WORM on the Mac as yet, but who knows!

> I have not seen this message and nothing I have can detect it on
> floppies that contain the "infected" files!  Supposedly SAM is one of
> the infected files as well as GateKeeper (and Aid)!

This is another case where an anti-viral program is reporting an
infection of another anti-viral program.  In all likelihood Vaccine
is finding the signature of the "DCD WORM" in SAM, Gatekeeper,
and Aid.  They may have the signature of the worm because they are
themselves scanning for its signature.

If one anti-viral program detects a virus or other nasty in another
anti-viral program, it is probably a false positive caused by the
fact that they both use (and therefore contain) the same signature.
Try scanning the supposedly infected anti-viral programs on clean
read-only distribution diskettes.  If this is indeed a signature
conflict, the clean anti-viral programs will still trigger a
false positive.

If you use two or more anti-viral or other security programs,
they are very likely to interact surprisingly, especially by
suspecting each other.  Security programs are "paranoid".  They
were designed that way and they have to be that way.

                        Robert McClenon
                        (Neither my employer nor anyone else
                        paid me to say this)


Brought to you by Super Global Mega Corp .com