This is to add virus definitions to the Symantec AntiVirus for the Macintosh or SAM™. Please refer to the about box within the SAM™ Intercept menu window to determine the version of SAM™ you currently own. This is very important to insure that you configure SAM™ properly for the particular version you own.
-----------------------
-----------------------
SAM™ version 2.0 owners:
New viruses and a Trojan horse have been discovered on the Mac, they are the Garfield 2 virus and the CDEF virus both discovered at Cornell U. on Aug. 13 and 15, 1990, the Trojan horse called Steroid, the Garfield virus, which was discovered at Cornell U. on May 16, 1990 and ZUC virus which was discovered in Italy on March 27, 1990.
The CDEF virus adds resources to the desktop files only and does not do anything intetionally malicious. To combat this virus with SAM™, virus definition information needs to be entered into SAM™ Virus Clinic. Open SAM™ Virus Clinic and make sure you've selected the Full Menus option. Select Add Virus Definition from the Definitions menu. Now enter the following information:
Virus name: CDEF
Resource Type: CDEF
Resource ID: 1
Resource Size 510
Search String: 4546 3F3C 0001 487A 0046 A9AB
String Offset: 420
Clicking the Add button will allow you to save this virus definition info to SAM™ Virus Clinic and SAM™ Intercept for immediate protection.
Garfield 2 aka MDEF 2 infects both applications and the system file. It renumbers the system menu definition number in the system file. You will experience problems when accessing applications or the basic system menus.
Symptoms of the original Garfield virus include odd menu behavior in some Macs and menus that don't pop down when clicked on. Entering the following information will detect ALL strains of Garfield:
Virus name: Garfield
Resource Type: MDEF
Resource ID: 0
Resource Size: any
Search String: A9A9 2F0C A9AA 2F0C A9B0
String Offset: any
Steroid is an INIT that claims to speed up Quickdraw on Mac computers with 9" screens. The INIT contains code that checks for the date being greater than June 6, 1990. If it is, it will erase all mounted volumes. Enter the following information to the Virus Definition window:
Virus name: Steroid Trojan
Resource Type: INIT
Resource ID: 148
Resource Size: 1080
Search String: ADE9 343C 000A 4EFA FFF2 4A78
String Offset: 96
Symptoms of the ZUC virus include wild cursor movement that occurs several minutes after an infected application is run. Enter the following information to the Virus Clinic Definition window:
Virus name: (capitals) ZUC
Resource Type: (capitals) CODE
Resource ID: 1
Resource size: any
Search string: (no spaces) 4E56 FF74 A036 41FA 04D2 5290
String offset: any
If you have a technical question regarding SAM™, call between 8 & 12 or 1 & 5 Pacific time, Monday through Friday at 408-253-2167.
-----------------------------------
-----------------------------------
SAM™ version 2.0.1 and 2.0.2 owners:
New viruses and a trojan horse have been discovered on the Mac, they are the Garfield-2 virus and the CDEF virus both discovered at Cornell U. on Aug. 13 and 15, 1990, the Trojan horse called Steroid and the Garfield virus which was discovered at Cornell U. on May 16, 1990.
The CDEF virus adds resources to the desktop files only and does not do anything intetionally malicious. To combat this virus with SAM™, virus definition information needs to be entered into SAM™ Virus Clinic. Open SAM™ Virus Clinic and make sure you've selected the Full Menus option. Select Add Virus Definition from the Definitions menu. Now enter the following information:
Virus name: CDEF
Resource Type: CDEF
Resource ID: 1
Resource Size 510
Search String: 4546 3F3C 0001 487A 0046 A9AB
String Offset: 420
Clicking the Add button will allow you to save this virus definition info to SAM™ Virus Clinic and SAM™ Intercept for immediate protection.
Garfield 2 aka MDEF 2 infects both applications and the system file. It renumbers the system menu definition number in the system file. You will experience problems when accessing applications or the basic system menus.
Symptoms of the original Garfield virus include odd menu behavior in some Macs and menus that don't pop down when clicked on. Entering the following information will detect all strains of Garfield:
Virus name: Garfield
Resource Type: MDEF
Resource ID: 0
Resource Size: any
Search String: A9A9 2F0C A9AA 2F0C A9B0
String Offset: any
Steroid is an INIT that claims to speed up Quickdraw on Mac computers with 9" screens. The INIT contains code that checks for the date being greater than June 6, 1990. If it is, it will erase all mounted volumes. Enter the following information to the Virus Definition window:
Virus name: Steroid Trojan
Resource Type: INIT
Resouce ID: 148
Resource Size: 1080
Search String: ADE9 343C 000A 4EFA FFF2 4A78
String Offset: 96
If you have a technical question regarding SAM™, call between 8 & 12 or 1 & 5 Pacific time, Monday through Friday at 408-253-2167.
--------------------------
--------------------------
SAM™ version 2.0.3 owners:
You have complete protection from all known viruses. If you have a technical question regarding SAM, call between 8 & 12 or 1 & 5 Pacific time, Monday through Friday at 408-253-2167.
