Path: utzoo!utgpu!jarvis.csri.toronto.edu!mailrus!cornell!biar!trebor
From: trebor@biar.UUCP (Robert J Woodhead)
Newsgroups: comp.sys.mac
Subject: Re: Hang due to floppy copy -- update
Message-ID: <376@biar.UUCP>
Date: 14 Mar 89 15:59:18 GMT
References: <581@salgado.stan.UUCP>
Reply-To: trebor@biar.UUCP (Robert J Woodhead)
Organization: Biar Games, Inc.
Lines: 46

In article <581@salgado.stan.UUCP> dce@stan.UUCP (David Elliott) writes:
>
>Last night, I was downloading some new programs, and as the finder was
>rebuilding the desktop, it hung again.  I rebooted, and every time the
>finder started trying to rebuild the desktop (whether I told it to or
>not), it would hang.

1) You were downloading programs.  What does this suggest?
2) Why would the desktop need to be rebuilt after this?

>
>I ran Disk First Aid and it found and fixed a problem.  I ran the disk
>verification tests, and no problems were found.
>
>After that, every time the finder tried to start up, it told me that
>"minor disk repairs" needed to be made.  I let it try, but it hung
>every time.
>

This sounds suspiciously like a virus called ANTI from France.  You
should take several steps to determine if this is so, immediately.

* The latest version of VirusDetective has new checks for ANTI.
  It just got posted to comp.sources.mac.

* Virex 1.3 [disclaimer, I am the author] can cure ANTI.  If you have
  1.3, run it.  If you have an earlier version, consider upgrading
  (especially if VirusDetective tells you ANTI is around)

* AntiToxin (another commercial product) can reportedly kill ANTI
  as well.

* Boot off a clean floppy.  Rename the finder on you hard old_finder
  and copy a new finder onto your hard disk.  Reboot off the hard
  disk and see if the problem reoccurs; if it doesn't, your finder
  was infected, as was every other program you have run since you
  got infected.  At this point, you must either use VirusDetective
  to locate these files and replace them, or one of the commercial
  tools to scan your disk and _repair_ them.



-- 
* Robert J Woodhead * The true meaning of life is cunningly encrypted and *
* uunet!biar!trebor * hidden somewhere in this signature...               *
* Biar Games, Inc.  *                       ...no, go back and look again *