From JLN@nuacc.acns.nwu.edu Tue Nov 15 15:25:33 1988 Flags: 000000000011 Received: from accuvax.nwu.edu (northwestern.arpa) by rascal.ics.utexas.edu (3.2/4.22) id AA21977; Tue, 15 Nov 88 15:25:29 CST Received: from nuacc.acns.nwu.edu by accuvax.nwu.edu id aa20017; 15 Nov 88 15:20 CST Date: Tue, 15 Nov 88 15:22 CST From: John Norstad Subject: Viral Resources To: info-mac@sumex-aim.stanford.edu, werner@rascal.ics.UTEXAS.EDU X-Vms-To: IN%"info-mac@sumex-aim.stanford.edu",IN%"werner@rascal.ics.utexas.edu",JLN Message-Id: <8811151520.aa20017@accuvax.nwu.edu> Status: RO Someone asked for a list of known Mac viruses and their resource identifications, so that users of Virus Detective could update the list of suspicious resources, and so that users of ResEdit would know what to look for. Here's what I know about Scores and two strains of nVIR: Scores infected system files: Type ID Size Files ---- ---- ----- ------------------------------------- INIT 6 772 System, Note Pad File, Scrapbook File INIT 10 1020 System, Desktop, Scores INIT 17 480 System, Scrapbook File atpl 128 2410 System, Desktop, Scores DATA -4001 7026 System, Desktop, Scores Scores infected application: Type ID Size ---- ---- ----- CODE n+1 7026 where n = the id of the first unused CODE resource. For example, if the application has CODE resources numbered 0,1,2,3,4,5, then n=6 and the viral CODE resource is numbered n+1=7. nVIR infected System file: Type ID Size A Size B ---- ---- ------ ------ INIT 32 366 416 nVIR 0 2 2 nVIR 1 378 428 nVIR 4 372 422 nVIR 5 8 8 nVIR 6 868 66 nVIR 7 1562 2106 nVIR infected application: Type ID Size A Size B ---- ---- ------ ------ CODE 256 372 422 nVIR 1 378 428 nVIR 2 8 8 nVIR 3 366 416 nVIR 6 868 66 nVIR 7 1562 2106 Unlike Scores, nVIR does not infect any files in the system folder other than the System file itself. The two columns "A" and "B" above are the sizes for what I call "nVIR strain A" and "nVIR strain B". Hope this helps. John Norstad Academic Computing and Network Services Northwestern University Bitnet: jln@nuacc Internet: jln@nuacc.acns.nwu.edu