Path: utzoo!mnetor!uunet!mcvax!unido!fauern!faui44!msurlich
From: msurlich@faui44.UUCP (Matthias Urlichs )
Newsgroups: comp.sys.mac
Subject: Re: nVIR virus - you may think you don't have it...
Message-ID: <240@faui10.UUCP>
Date: 28 Mar 88 08:48:14 GMT
References: <502@sdacs.ucsd.EDU>
Reply-To: msurlich@faui10.UUCP (Matthias Urlichs)
Organization: CSD., University of Erlangen, W - Germany
Lines: 18
Summary: Looking for nVIRs

In article <502@sdacs.ucsd.EDU> wade@sdacs.ucsd.EDU (Wade Blomgren) writes:
> when opening a System File with ResEdit while booted from
> that same system, a large number of resources INCLUDING 'nVIR'
> don't show up in the ResEdit resource list.
 
 This shows up under MultiFinder only, and with ResEdit prior to version 1.2.

> Also, note that the nVIR virus does seem to infect the Finder, the
> DA Handler, as well as normal (APPL type) applications.

The virus patches TEInit(). So every program that calls this trap gets
infected.

-- 
Matthias Urlichs              CompuServe: 72437,1357  Delphi: URLICHS
Rainwiesenweg 9
8501 Schwaig 2                "Violence is the last refuge
West Germany                            of the incompetent." -- Salvor Hardin