Xref: utzoo comp.sys.mac.apps:4450 comp.sys.mac.wanted:2904
Path: utzoo!news-server.csri.toronto.edu!cs.utexas.edu!wuarchive!udel!rochester!BBN.COM
From: levin@BBN.COM (Joel B Levin)
Newsgroups: comp.sys.mac.apps,comp.sys.mac.wanted
Subject: Re: My mac is infected -- what to do?
Message-ID: <63104@bbn.BBN.COM>
Date: 5 Mar 91 17:08:58 GMT
Sender: news@bbn.com
Followup-To: comp.sys.mac.apps
Organization: Bolt Beranek and Newman Inc., Cambridge MA
Lines: 33
In-Reply-To: <91064.094356GFX@psuvm.psu.edu>

In article <91064.094356GFX@psuvm.psu.edu> you write:
|             o the virus interacts with Gatekeeper aid. If I do not put GK Aid
|               on my drive, there are very few sides effects, so far. IF GK Aid
|               is in, I'll get the "Desktop needs to be rebuilt" message each
|               time I boot, or re-enters the Finder.
|
|             o the virus is undetectable by Disinfectant 2.4  .  I get, however
|               several warnings of either kind: (a) "the resource fork is
|               damaged or in an unknown format..."; (b) "not enough memory to
|               check."  10 files trigger either message.
|
|             o For at least one application (Disinfectant), I cannot change the
|               application size in the Get Info window. When I close the window
|               I get an error [-199]  Other applications are unaffected.
|
|             o If I use MacSnoop or resEdit to look into the desktop, I get an
|               error [-49] and a message tells me that the file is already
|               opened with write permission

These problems indicate that the first thing you have to do is reboot
WITHOUT Multifinder.  Then you can look at the desktop; then
Disinfectant can run properly (and you may need to capture a fresh
copy, if it detects problems within itself).

Scanning and especially disinfecting under Multifinder leads to
questionable results, in any case.  See the instructions in
Disinfectant's help window.

	/JBL
==
Nets: levin@bbn.com  | "How does a mouse let me move the cursor anywhere 
 or {...}!bbn!levin  |  I want?"  "What are address busses?"  "How do 
pots: (617)873-3463  |  icons work?"              --Time-Life Books