From JLN@nuacc.acns.nwu.edu Tue Nov 15 15:25:33 1988
Flags: 000000000011
Received: from accuvax.nwu.edu (northwestern.arpa) by rascal.ics.utexas.edu (3.2/4.22)
id AA21977; Tue, 15 Nov 88 15:25:29 CST
Received: from nuacc.acns.nwu.edu by accuvax.nwu.edu id aa20017;
15 Nov 88 15:20 CST
Date: Tue, 15 Nov 88 15:22 CST
From: John Norstad <JLN@nuacc.acns.nwu.edu>
Subject: Viral Resources
To: info-mac@sumex-aim.stanford.edu, werner@rascal.ics.UTEXAS.EDU
X-Vms-To:
IN%"info-mac@sumex-aim.stanford.edu",IN%"werner@rascal.ics.utexas.edu",JLN
Message-Id: <8811151520.aa20017@accuvax.nwu.edu>
Status: RO
Someone asked for a list of known Mac viruses and their resource
identifications, so that users of Virus Detective could update the
list of suspicious resources, and so that users of ResEdit would know
what to look for.
Here's what I know about Scores and two strains of nVIR:
Scores infected system files:
Type ID Size Files
---- ---- ----- -------------------------------------
INIT 6 772 System, Note Pad File, Scrapbook File
INIT 10 1020 System, Desktop, Scores
INIT 17 480 System, Scrapbook File
atpl 128 2410 System, Desktop, Scores
DATA -4001 7026 System, Desktop, Scores
Scores infected application:
Type ID Size
---- ---- -----
CODE n+1 7026
where n = the id of the first unused CODE resource. For example,
if the application has CODE resources numbered 0,1,2,3,4,5, then
n=6 and the viral CODE resource is numbered n+1=7.
nVIR infected System file:
Type ID Size A Size B
---- ---- ------ ------
INIT 32 366 416
nVIR 0 2 2
nVIR 1 378 428
nVIR 4 372 422
nVIR 5 8 8
nVIR 6 868 66
nVIR 7 1562 2106
nVIR infected application:
Type ID Size A Size B
---- ---- ------ ------
CODE 256 372 422
nVIR 1 378 428
nVIR 2 8 8
nVIR 3 366 416
nVIR 6 868 66
nVIR 7 1562 2106
Unlike Scores, nVIR does not infect any files in the system folder
other than the System file itself. The two columns "A" and "B" above
are the sizes for what I call "nVIR strain A" and "nVIR strain B".
Hope this helps.
John Norstad
Academic Computing and Network Services
Northwestern University
Bitnet: jln@nuacc
Internet: jln@nuacc.acns.nwu.edu
��������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������������