WDEF Virus Update—January 3, 1990 Edited by : M. B. Hoffman — AppleLink: N0831
Source material obtained from:
John Norstad, NorthWestern University; Dec 7, 1989
Susan V. Monjan, 1st Aid Software, Inc.; Dec. 12, 1989.
Symantec, Dec. 21, 1989.
The editor has assumed the privilege of reproducing this material in its edited form, without the expressed permission of the listed sources. There is a salient intent to educate the readers of this editing, not to subordinate principles, or facts or individuals. Many thanks to the originators and supporters of the following information — may our readers prosper in the fruits of your labors.
INFORMATION -----------------------------------------
The following is an update on the status of the WDEF virus:
A new Macintosh virus named "WDEF" has been discovered in Belgium, at Northwestern University, and at the University of Texas.
The WDEF virus spreads itself from machine to machine by infecting the Desktop files of mounted volumes. If the Finder is active either under MultiFinder or as the current application, the Finder opens the Desktop file of a volume being mounted. The WDEF viral resource in the Desktop file then becomes the active window definition procedure and infects other volumes mounted on this machine. This means you can infect your machine by inserting a floppy which was not true of previous viruses.
There are currently two strains of the WDEF virus. Some of the virus protection utilities currently available had already been modified to detect the first strain before the second strain made its appearance. It is important to get the latest versions of software to ensure protection/detection capabilities for both strains. The following are some of the symptoms that have been reported as being associated with this virus:
* Due to a bug the virus causes both the Mac IIci and the portable to crash.
* Unusually frequent crashes on infected Mac IIcxs.
* Under some circumstances the virus can cause severe performance problems on AppleTalk networks with AppleShare servers.
* Many people have reported frequent crashes when trying to save files in applications under MultiFinder.
* The virus causes problems with the proper display of font styles (the outline style in particular).
* Two reports that the virus can damage disks.
* A single report that the virus causes Macs with 8 megabytes of memory to crash.
* A single report that the virus is incompatible with the "Virtual" INIT from Connectix.
The virus does not intentionally try to do any damage. In fact, it doesn't do anything except spread from disk to disk, it does not infect applications, data files, or system files.
You do not have to run a program for the virus to spread.
Unlike most of the other Mac viruses, the WDEF virus is not spread via the sharing and distribution of programs, but rather via the sharing and distribution of disks, usually floppy disks.
Unfortunately, the virus manages to avoid detection by all of the popular protection INITs, including Vaccine 1.0.1, GateKeeper 1.1.1, SAM Intercept 1.10, and Virex INIT 1.12. GateKeeper Aid (FreeWare), when properly installed in the System Folder, will inhibit the spread of the virus to a disk.
Disinfectant 1.3, Virus Rx 1.5, SAM Virus Clinic 1.10, and Virex 2.12 also all fail to detect the virus. Disinfectant 1.5 is available on AppleLink and GEnie; It is a freeware utility well worth having. Version 1.4 was written to detect the first strain of the WDEF virus. Version 1.5 detects both strains and goes beyond this in trying to detect other viruses of the same nature.
SAM 1.4 from Symantec detects both strains and provides protection as well as detection capabilities. Version 1.3 only detects the first strain of the WDEF virus. SAM 1.4 is expected to be available late in the first week of January 1990. Virex 2.2 and its INIT are also expected to be available during this timeframe.
Virus Detective (shareware v3.1) can locate the WDEF virus if you add the following search string:
Creator=ERIK & Resource WDEF & Any ; For finding WDEF
Virus Detective ( v3.1.1) includes this search string.
Version 1.5 of Virus Rx does not detect the WDEF virus, but Apple Computer Inc. still recommends having it and using it since having multiple defenses against viruses makes it that much harder for viruses to spread. Virus Rx is being changed to accommodate WDEF detection.
If you do not have any utilities with you, you can still keep your system from being infected by the WDEF virus. By rebuilding the Desktop file of diskettes as they are inserted, you can keep the WDEF virus from becoming active. The following is the procedure necessary to do this:
1) Your current application must be the Finder. If you are running MultiFinder, you should have the Finder's menus in the menu bar.
2) Hold down the Command and option keys together.
3) With these keys held down, insert the unlocked floppy.
4) You will be asked if you wish to rebuild the Desktop file.
5) Answer Yes. If you cancel at this point, and the floppy is infected, you will infect your system.
As of this writing, I recommend the installation of GateKeeper Aid and Vaccine in all Macintosh System Folders. I further suggest the procurement and installation of SAM Intercept™1.4 INIT; and the conscious excecution of SAM Virus Clinic™ 1.4, Apple's Virus Rx, and Disinfectant 1.5 each day. This regimen may seem like a reaction to a bit of paranoia, but I suggest that this prescription can be a reminder to you of the ever-presence of viruses, and it is better to educate yourself now than after an attack at an inconvenient time.
As A final footnote, 1st AID Software, Inc. has an excellent product, which will prevent the effects of the current WDEF virus. The downside of this information is that 1st Aid has informed the LEAUG that it has elected to encourage hardware solutions to the virus issue, and not escalate the virus issue in the face of the new stealth mechanisms. 1st Aid has decided not to update their Anti-Virus Kit but will continue to provide technical support to registered owners. The 1st Aid Software product "1st Aid Kit" remains viable in its latest version, and supports virtually all Macintosh hard disk and floppy configurations.
