Path: utzoo!attcan!uunet!tank!ncar!ames!coherent!dplatt
From: dplatt@coherent.com (Dave Platt)
Newsgroups: comp.sys.mac
Subject: "INIT 29" virus report
Summary: Just thought you'd want to know...
Message-ID: <17098@coherent.com>
Date: 3 Jan 89 22:52:13 GMT
Distribution: comp
Organization: Coherent Thought Inc., Palo Alto CA
Lines: 31

This week's issue of MacWeek contains a report (page 3) of a new Mac
virus discovered at the University of California.  This virus is
reported to be "particularly virulent";  if your machine is infected,
the virus will [attempt to] infect new disks as soon as they're
inserted.  It isn't necessary to launch an application to trigger an
infection attempt, as is the case with SCORES and nVIR.

The new virus has been dubbed "INIT29" by the Computer Virus Industry
Association, after one of the resources that it installed.  The
signature of this new virus: CODE resources (712 bytes) are added to
applications, and INIT resources (ID=29, 712 bytes) are added to "all
other files."

Also mentioned in this report is the "Hpat" strain of the nVIR virus,
reported in this newsgroup a couple of weeks ago.

An accompanying article mentions three new/updated antiviral programs
that should be available soon:  VirOut (a package that includes both a
"vaccine" and a "serum") by Mainstay;  an updated version of Virex
(Robert Woodhead's commercial successor to Interferon) that will detect
both Hpat and INIT29;  and an updated version of VirusDetective, a
shareware antiviral d/a by Jeffrey Shulman.

Disclaimer:  I'm only reporting what I just read;  if it's not correct,
well...

-- 
Dave Platt    FIDONET:  Dave Platt on 1:204/444        VOICE: (415) 493-8805
  UUCP: ...!{ames,sun,uunet}!coherent!dplatt     DOMAIN: dplatt@coherent.com
  INTERNET:   coherent!dplatt@ames.arpa,    ...@sun.com,    ...@uunet.uu.net 
  USNAIL: Coherent Thought Inc.  3350 West Bayshore #205  Palo Alto CA 94303