Distributed by the Mac Pack and the Dallas Apple Corps for all members of the Macintosh community.
Special thanks to John Cail, Doug Ruddman, Kelly and Cheney Coker, and Steve Schroader for their assistance.
1. Introduction
A virus is an organism that attacks and feeds off a host until either the virus or the host dies. A so-called Scores virus has spread throughout the Macintosh community. This virus, however, is a nasty piece of software written by a demented individual. Just like a living organism, it reproduces itself and has spread like an epidemic. Rumors (and there are PLENTY!) are that thousands of U.S. Government Macintoshes — including those owned by NASA— are infected, and that the FBI is investigating the outbreak. In addition, Apple, other major corporations, and probably hundreds of thousands of business and private users are infected. This is NOT the MacMag virus, which was relatively benign and was inadvertently spread by Aldus in a few copies of FreeHand. It is NOT the nVIR virus, which so far has spread very little, according to published sources. It IS a virus that was purposely designed to spread itself as rapidly as possible. Scores will enter a disk as part of an application. It will spread to the System, then to other applications, some of which will be given to a friend or taken to work, spreading it even further. There is evidence that it can spread through a network. Scores will damage programs, causing unpredictable problems. Its primary intent has not yet been discerned. Don't be the first to discover the evil purpose for which this virus was designed. Get it out of all systems in which it is located, and do it NOW!
2. Detection
Open the System Folder on all disks in your possession, especially hard disks. Look for two icons representing the Scrapbook File and Note Pad File. The System is infected if BOTH of them are there AND if both icons are generic document icons, i.e., blank dog-earred pages. The System is probably not infected if neither or only one icon is present or if the icons look like Macintoshes, the same icon used for the System and Finder. If the disk is infected, do not panic. This document tells how to remove the virus from the System and prevent its recurrence. If the disk is not infected, learn here how to protect yourself and to help someone else remove the virus.
Good News! Bad News!
Figure 1
3. Discussion of Macintosh Program Structure
Macintosh programs which are used to perform productive tasks are called applications. Common applications are MacWrite, MacPaint, and Microsoft Word. Other applications with which everyone is familiar are the Font/DA Mover, HyperCard, and TeachText. Many users do not realize that the Finder is also an application.
Items created by applications are called documents. A letter created with MacWrite, for instance, is a document. There are other items on a Mac like System and General, which are neither applications nor documents. These items, along with applications and documents, may be termed files. Generically, any item on a Macintosh which has an icon is called a file.
Macintosh files are composed of smaller groups of software called resources and data. Thus any Macintosh file may contain data, resources, or both. An application is comprised primarily of resources, a document primarily of data. Resources with which everyone is familiar are fonts and icons. Others of importance to this discussion are CODE and INITs. CODE is contained in virtually every application, for it is really the heart of the application itself. CODE is the set of commands which controls all the other resources. An INIT is a set of instructions which is loaded into the Mac's memory when power is turned on and a disk is inserted. INITs are executed in alphabetical order. Common INITs are Suitcase and Pyro.
Apple has provided an application called the Resource Editor, ResEdit, or ResEd for short. It is a necessary tool for both identification and removal of this virus, but it is quite powerful and beginners are urged to avoid any uses of this program other than those described here.
4. Analysis of Infected Application
The Scores virus seems to attack only files which have CODE resources, primarily applications. Although it is possible for documents to contain CODE, no specific examples are known. It should be mentioned that files which have been stored in the Stuffit format contain no resources at all, so a file saved or archived in that manner should be impervious to infection IF it was clean when Stuffed.
To observe the infected application, open ResEd, and you will see a window like:
Figure 2
Selecting the infected application by double clicking on its name, in this case ResEd itself, we see
Figure 3
Opening the CODE resource by double-clicking on the name shows:
Figure 4
Notice that the first CODE on the list (CODE ID = 7) has an ID which is numbered two higher than the next highest (CODE ID = 5). Selecting this resource by clicking on it once and choosing Get Info from the File menu reveals a size of 7026 bytes:
Figure 5
This is the final proof that the application is infected. (An examination of an uninfected copy of ResEd would show that CODE 7 was not present.) In addition to this easily detectable change, CODE 0 has been modified and there is at least one other alteration, the details of which are unknown to the author at this time.
5. Effects of Using an Infected Application
When an infected application is opened, its new CODE commands tell it to add several new pieces of software to the System Folder. Two of these are quite important because they provide the best clue that something is wrong: Scrapbook File and Note Pad File, as discussed in Section 2. Other changes the virus makes to the System Folder are less obvious: It adds a Desktop file and a file called Scores, from which the virus gets its name. These files cannot be observed from the Finder because they are invisible. Programs such as ResEd and MacTools show them to be there, however. The virus also modifies the System itself, adding the following resources: atpl ID 128, DATA ID -4001, and INITs with ID's of 10, 6, and 17. With these new INIT resources in the System, the Mac is figuratively a fused bomb, ready to do damage the next time it is turned on.
6. Spread of Virus to Uncontaminated Applications
Because these new resources are primarily INITs, they are activated the next time the Mac is started. Once initialized, the virus begins to execute the commands which cause it to spread. As the infected disk is used, the virus continually seeks uncontaminated applications. The present thought is that it searches in a random fashion at an interval of three and a half minutes. At times a disk drive will begin operating when nothing should be happening. This occurs because the virus is writing its code resource to another application. After a long enough period of time, every application on the disk will be infected, apparently whether it has been used or not.
7. Prevention of Occurrence or Recurrence
CE Software has released into the public domain a utility called Vaccine. Vaccine is a "cdev," which means "Control Panel Device." Copies are free. Get it from a Disk-of-the-Month (DOM) at a user group meeting or from a telephone communication service such as CompuServe or GEnie. To use it, place the Vaccine icon in the System Folder. Select Control Panel from the Apple menu and you will see "Vaccine" listed right under "General." Close examination will reveal that the name begins with a space before the "V." Leave it that way so it will be the first thing that operates when the Mac is started or reset. Select the Vaccine icon and read the instructions. In case you do not understand them, putting an "X" in the top and bottom boxes is recommended. Be sure to restart the Mac after setting Vaccine in order to start it working.
To help assure that you have a clean copy of Vaccine, select the Vaccine icon while at the Finder (not the Control Panel) and choose Get Info from the File menu. Verify that the size is 11,875 bytes and that the creation date is Saturday, March 19, 1988, at 11:49 PM. We must assure that no one creates a bogus version of this fine work. And thank you, CE Software!
After Vaccine has been installed, look for the following symptoms when using the Mac or opening an application; each is an indication that the virus is in operation:
(1) Vaccine randomly asks for permission to alter a resource.
(2) Opening an application triggers Vaccine.
(3) Opening a resource causes a bomb (usually ID = 02).
(4) Opening an application causes the Mac to hang up.
Do not put a copy of any application on a hard disk until it has been checked for contamination. Do not run a new copy of any program until it has been checked out. Examine any program before uploading it to a Bulletin Board.
8. Removal of Virus from System
Since the relatively recent discovery of this virus, several programmers are working on developing software which will do any or all of the following: detect the presence of the virus, remove it from the System Folder, detect infected applications, and/or repair the infected applications. As of this writing, however, none are available. What follows is a step-by-step procedure that will enable you to clean up a disk with or without one or more of these utility programs.
First, install the Vaccine utility if it is available and reboot the Mac. (Note: If you see a bomb, a hangup, or a message from Vaccine when booting, the Finder is contaminated. Boot with a clean floppy and replace the Finder on the virused disk.) Open ResEd. (Note: If you see a bomb, a hangup, or a message from Vaccine when trying to open ResEd, ResEd itself is contaminated. Replace it with a clean copy.) At this point you will see the files at the so-called root level of the disk, resembling Figure 2. Notice the file called DeskTop. This is NOT the bad file. Scroll through the window and open the System Folder by double clicking on its name. You will see a window resembling Figure 6.
Figure 6
Select the Desktop file by clicking on it one time, then choose Clear from the Edit menu. Do the same thing for the other three infection files, Note Pad File, Scores, and Scrapbook File.
Locate the System and double click on its name to open it. You will observe a window similar to Figure 7.
Figure 7
Locate atpl and open it by double clicking. Select atpl ID 128 and Clear it by using the Clear command under the Edit menu. Close atpl and open DATA. Clear DATA ID -4001. Close it and open INIT. Clear ID 10, ID 17, and ID 6. Close all windows except the root level window and save the changes when asked if you wish to.
Important: A virgin System (4.1, at least) from Apple does not contain either resource of the types atpl or DATA, but some programs — LaserSpeed, for one — legitimately place them in the System. Remove only the ID numbers listed.
The System is now free of infection, but the work is far from over. When Vaccine has been properly installed on the disk, opening an infected application will cause either a bomb, a message from Vaccine, or the Mac will hang up. In any case, the application should be examined more closely: Use ResEd to open the CODE resource of the suspected application. If the top CODE ID is two numbers higher than the next highest, Get Info on it. If the size is 7026, as shown in Figure 5, it is an infected application. Throw it in the trash because it is unusable and will reinstall the virus into the System if it is run with Vaccine off or not installed.
Even if you do not yet have a copy of Vaccine, use ResEd to examine every application on your disks. Notice the small icon next to the Font/DA Mover name in Figure 2. This icon will help in determining which files on the disk are applications. Check ALL of the applications in the manner described above. It is easy to overlook some of the smaller and perhaps lesser used ones like Font/DA Mover and backup programs. Remember, the Finder is an application. And an application does not have to have been run for it to be contaminated.
Experiences with this virus over the past four months have shown this to be an effective and relatively simple way to clean a disk. There is nothing wrong with replacing the System, replacing the System Folder, or re-initializing the hard drive. These, however, are extreme measures and are not considered by the author to be necessary. In any case make sure, with ResEd, that all applications put back on the hard drive are clean, especially if Vaccine has not yet been installed, or the whole cycle could begin again.
For more advanced users: After it is felt that all infected applications have been removed and replaced, run Disk Express, if available, with the Erase Free Space option turned on. This will cluster the data to the start of the disk and zero out all remaining space. Then use Fedit, MacTools, or a similar program to search for two strings virtually unique to this virus: VULT and ERIC. Each string is all caps. If these strings are nowhere on the disk, it is clean. If they are still there, do everything possible to find out which file they are in and remove it from the disk. Repeat this until there is no ERIC or VULT. (The only application so far discovered which contains the VULT string is one called DD Editor, and it does not contain ERIC.) Searching a previously infected disk in this manner without having run Disk Express first does no good because the infected files were not actually erased when trashed and the remnants are probably still on the disk. In other words, the presence of ERIC and VULT at this stage of the removal process does not mean that the disk is still infected, but their absence DOES mean that the disk is clean.
9. Removal of Virus from Infected Applications
Unfortunately, at this time there is no known method to repair infected applications, and perhaps there never will be. There is evidence that when the virus attaches itself to an application and inserts the new CODE resource, at least a part of the new CODE is apparently written over some part of the original application software, permanently destroying it. If true, this would account for the many strange effects of the virus because the missing code would be different in each application. There would have to be a separate fix for every application. The safest thing to do is to trash every bad application from the disk and replace it with a known clean copy. If there is no clean copy backed up, save the infected version on a floppy in hopes that a fix will be found.
10. Comments
Cleaning the virus from one disk will not fix the problem. ALL Macintosh disks must be clean or the problem will be around for a long, long time. And not just YOUR disks: EVERYONE'S disks! After you are familiar with the problem and its solution, share your knowledge. Make as many reproductions of this document as you wish to and give them to anyone with a Mac. It is copyrighted in the hopes that the editorial content will not be altered, but permission is given for the widest possible distribution. Print copies in your club or company newsletter. Visit dealers and see if they are virus-free. Help them spread the word. Do what you can — it will cost you only a little time, not money.
Why am I taking the time to create this document? I had the virus as early as November of 1987, but dismissed the problem as an offshoot of MultiFinder, due to the fact that the virus struck me just as I had decided to quit using MultiFinder and return to using System 4.1. I spent many hours of work over several weeks figuring it out and ridding myself of its effects. At the time I did not recognize it as a virus, and for that I am very sorry. I should have pounded on Apple's doors relentlessly asking about this problem. Possibly someone there would have recognized it for what it was, early enough to prevent the present massive outbreak of the problem.
I have enjoyed my Mac for well over four years now. I have created three fonts with it, one shareware and two that have actually been published. I have had fun with my Mac, and I have earned money with it. I am a member of two Macintosh clubs and have made many good friends because of this small computer. I can't stand by while some jerk destroys so much of my life. The time has come to repay the Mac community and this is my way.
Help me. One hates to publish a phone number in a document designed for public distribution, but without it you could not relay any important information. Please call only from 8 AM to 8 PM Central time, and only if you have found some information not in this document. Long distance callers, please leave a complete message on the answering machine if it answers, as I cannot afford to return many long distance calls.
Both User Groups of which I am a member have access to AppleLink, a worldwide communications network operated by Apple Computer, so any new information can be relayed directly to the people at Apple who are working on solving this problem. And thanks for any help.
Howard Upchurch • 3409 O'Henry Drive • Garland, TX 75042
(214) 272-7826
I have reported information as I have found it. If there are any errors in the above, I apologize but ask not to be held responsible. Some statements may prove false or incomplete as more information comes to light.
