Path: utzoo!attcan!uunet!lll-winken!ames!mailrus!cornell!vax5!pv9y
From: pv9y@vax5.CIT.CORNELL.EDU
Newsgroups: comp.sys.mac
Subject: Re: Save me from nVIR !!!
Message-ID: <17702@vax5.CIT.CORNELL.EDU>
Date: 14 Jan 89 18:26:36 GMT
References: <141200001@cdp> <544NETOPRRW@NCSUVM> <17678@vax5.CIT.CORNELL.EDU> <34492@bbn.COM>
Sender: news@vax5.CIT.CORNELL.EDU
Reply-To: pv9y@vax5.cit.cornell.edu (PUT YOUR NAME HERE AND SMILE)
Organization: Cornell Information Technologies, Ithaca NY
Lines: 23

In article <34492@bbn.COM> levin@BBN.COM (Joel B Levin) writes:
>I strongly recommend AGAINST trying to remove nVIR from an application
>with ResEdit.  nVIR modifies an essential CODE resource (0); in
>addition to removing all the nVIR resources and CODE 256, you would
>have to open CODE 0 and unpatch it.  It's possible, but I wouldn't do
>it myself while the various eradication programs can do it for me.

Probably good advice unless you really know what you are doing.

>Also: Vaccination is used to detect attempts to change or add
>important resources; it does not clean up any infections.

Nope.  Vaccination comes in a package with Virus Warning INIT, which does
that, but the Vaccination program gives you a file selector box in which
you can select an infected program and have Vaccination remove the virus
code.  I've done it numerous times and checked with ResEdit.  Vaccination's
main problem is that it won't display system files, which can be infected,
in that file selector box, so it won't dis-infect them.  AntiPan does that
fairly well though.

>	/JBL

Adam Engst