Path: utzoo!dptcdc!jarvis.csri.toronto.edu!mailrus!tut.cis.ohio-state.edu!osu-20.ircc.ohio-state.edu!reeves-t
From: REEVES-T@osu-20.ircc.ohio-state.edu (Dusty)
Newsgroups: comp.sys.mac
Subject: 7 Meg MacWrite? Virus?
Keywords: Virus MacWrite
Message-ID: <12486843760008@osu-20.ircc.ohio-state.edu>
Date: 17 Apr 89 12:41:24 GMT
Sender: news@tut.cis.ohio-state.edu
Organization: The Ohio State University, Columbus, Ohio
Lines: 25


This is a strange one. I observed an oddity on a Mac SE
in a public acess pc site here at OSU. The MacWrite program
on the hard disk was taking up 7 megs of space. I thought
it was probably a messed up directory listing, so I just threw it away
and restored MacWrite. No Problem. A couple of weeks
later I noticed that the MacWrite on my office SE was now 7,600,000 bytes.
I can't be sure if this is exactly the same size as the prior instance
 This time I investigated. Using res edit, i comared the MacWrite
file with a normal copy. I found that the STR resource (38 bytes) 
ID=801, found in normal copies of MacWrite 4.5, had been replaced by
FIVE STR ID=801, each wiht a listed size of
1,819,044. AS 5*1.8 is>7.6 there
is something esle going on too, but I didn't find it.

I found nothing more. I trashed that MacWrite. Alls well.

But - is this just a bizarre coincidence? Anyone seen this out there?

Both copis of the 7 meg Macwrite still functioned, by the way.



Terry Reeves
Reeves-t@osu-20.ircc.ohio-state.edu