Path: utzoo!attcan!uunet!lll-winken!ames!ncar!gatech!bloom-beacon!bu-cs!dartvax!eleazar.dartmouth.edu!isle
From: isle@eleazar.dartmouth.edu (Ken Hancock)
Newsgroups: comp.sys.mac
Subject: nVIR -- good news, bad news
Message-ID: <11756@dartvax.Dartmouth.EDU>
Date: 13 Jan 89 21:05:04 GMT
Sender: news@dartvax.Dartmouth.EDU
Reply-To: isle@eleazar.dartmouth.edu (Ken Hancock)
Organization: Personal Computing Center, Dartmouth College
Lines: 50


DISCLAIMER:  This is not meant to be alarmist.  Merely information to
             use as you would any other.

THE BAD NEWS:

Well, it's been said that nVIR will infect Systems, Finders, and
Applications.  Add another category to that.  SOME INITs.

For those of you disbeliving minds, on a rainy day try this:

1. Install SuperLaserSpool 5.0 on a disk with a System Folder.
   (I used System 6.0.2)
2. Startup, run an infected application, bingo.  Your System
   is infected.
3. Restart your computer, bingo.  SuperLaserSpool is infected.
   NOTE: Interferon will pick both of these infections up.
4. Disinfect using your favorite program.  Did you notice that
   neither Repair, AntiPan, Vaccination, or any other program
   will disinfect INITs?  (save for one...see below).
   Run Interferon.  Note that SuperLaserSpool is still infected.
5. Restart your Mac.  When SuperLaserSpool INIT runs, it infects
   your System.  (See a cycle developing?)

THE GOOD NEWS:
  Use the program I use, KillVirus INIT.  KillVirus will:
         1. Protect your mac from future infection by installing
            an nVIR 10 resource which keeps nVIR from infecting
            the System.
         2. Disinfect both SuperLaserSpool and System on startup,
            and disinfect any infected application whenever it
            is launched.

Now, if some nVIR guru will tell me how the above can happen
when supposedly nVIR cannot infect anything but Systems, Finders,
and Applications?  I haven't looked into any other special INITs.
Who knows how many special INITs there are that act in this manner?

If you have any question or answers, please post or e-mail.

Ken Hancock





Ken Hancock  '90                   | BITNET/UUCP/
Personal Computing Ctr Consultant  |   INTERNET:  isle@eleazar.dartmouth.edu
-----------------------------------+----------------------------------------
DISCLAIMER?  I don't get paid enough to worry about disclaimers.