Path: utzoo!utgpu!jarvis.csri.toronto.edu!mailrus!tut.cis.ohio-state.edu!cwjcc!hal!nic.MR.NET!csd4.milw.wisc.edu!bionet!ames!amdcad!sun!pitstop!sundc!seismo!uunet!munnari!murdu!ucsvc!mvax!lgeorge
From: lgeorge@melbcae.edu.au
Newsgroups: comp.sys.mac
Subject: RWatcher taking me for a ride!
Message-ID: <258@melbcae.edu.au>
Date: 1 Feb 89 08:38:33 GMT
Organization: La Trobe University - Lincoln School of Health Sciences
Lines: 29

It would appear that RWatcher does NOT like MFS disks!  Well, either that or 
400K disks, but everytime I mounted this disk [which I checked and it was 
"clean"] the finder would beep 10 times and quit to the finder, which would 
again try to mount the disk and then beep 10 times and quit to the finder, etc.

Is it possible that it can't read the resources and therefore assumes that 
something fishy is going on?

I also checked the disk with Virus Detective(1.1).  I have my Virus Detective 
and my RWatcher looking for all the calls signs for nVIR (A and B), Scores, 
Hpat and INIT29, but Virus Detective didn't say a word, but RWatcher did the 
same loop again.

An interesting point about RWatcher, if someone installs it in a system folder 
that is already infected with a virus, as soon as you do something that 
involves moving resources, like drag copy or duplicate then RWatcher catches 
the virus attempt and beeps ten times and then quits to the finder.  Then it 
realises that the Finder is an infected application, so it beeps ten times and 
quits to the finder, and of course the Finder is an infected application, so it 
beeps ten times and quits to the Finder, etc...
I thought it was strange that RWatcher didn't notice that the System/Finder 
were infected on startup.

Anyway, just a few notes...
George Stamatopoulos
La Trobe University - Lincoln School of Health Sciences
Melbourne
Victoria
Australia