Disinfectant 2.8

April 19, 1992

Disinfectant 2.8 is a new release of our free Macintosh anti-viral 
utility.

Version 2.8 detects the new CODE 252 virus. 

The CODE 252 virus was discovered in California in April, 1992.

The virus is designed to trigger if an infected application is run or 
an infected system is started up between June 6 and December 31 of 
any year, inclusive. When triggered, the virus displays the following 
message:

   You have a virus.
   Ha Ha Ha Ha Ha Ha Ha
   Now erasing all disks...
   Ha Ha Ha Ha Ha Ha Ha
   P.S. Have a nice day
   Ha Ha Ha Ha Ha Ha Ha
   (Click to continue...) 

Despite this message, no files or directories are deleted by the virus. 
However, a worried user might turn off or restart a Macintosh upon seeing 
this message,  and this could corrupt the disk and lead to significant 
damage.

Between January 1 and June 5 of any year, inclusive, the virus simply 
spreads from applications to System files, and then on to other 
application files.

Due to errors in the virus, it only spreads to new applications under 
System 6 without MultiFinder. The Finder also usually becomes infected.

Under System 6 with MultiFinder, the virus infects the System file and 
the "MultiFinder" file, but it does not spread to new applications.

Under System 7, the virus infects the System file, but it does not spread 
to new applications. A bad error in the virus can cause crashes or damaged 
files under System 7.

Under any system, the virus infects the System file, and it can and will 
trigger the display of the message.

The virus contains a number of additional errors which could cause 
crashes, damage, or other problems on any system.

In addition to recognizing the new virus, there are a few other changes
in version 2.8 of Disinfectant.

Version 2.8 corrects an error in version 2.7.1 which caused crashes during 
or after scans on the Mac Plus and 512KE running System 6 with MultiFinder.

The protection INIT no longer checks the System file for viruses at 
startup time. This makes the INIT smaller, more efficient, and more 
robust. 

Version 2.8 also includes some changes to the protection INIT which we 
hope will make it more compatible with other software.

The "Protection" section of the online manual now discusses the problem 
of what to do when you want to use the Disinfectant INIT together with 
some other INIT which is supposed to load first.

Disinfectant 2.8 is available now via anonymous FTP from site 
ftp.acns.nwu.edu [129.105.113.52].  It will also be available soon on 
sumex-aim.stanford.edu, rascal.ics.utexas.edu, comp.binaries.mac, 
America Online, CompuServe, GEnie, Delphi, BIX, MacNet, Calvacom, 
AppleLink, and other popular sources of free and shareware software.

Macintosh users who do not have access to electronic sources of free and 
shareware software may obtain a copy of Disinfectant by sending a self-
addressed stamped envelope and an 800K floppy disk to the author at the 
address given below. People outside the US may send an international postal 
reply coupon instead of US stamps (available from any post office). Please 
use sturdy envelopes, preferably cardboard disk mailers.

People in Western Europe may obtain a copy of the latest version of 
Disinfectant by sending a self-addressed disk mailer and an 800K floppy 
disk to macclub benelux. Stamps are not required. The address is:

   macclub benelux
   Disinfectant Update
   Wirtzfeld Valley 140
   B-4761 Bullingen Belgium

John Norstad
Academic Computing and Network Services
Northwestern University
2129 Sheridan Road
Evanston, IL 60208 USA

Internet: j-norstad@nwu.edu