MacFormat 1995 April/macformat-023.iso/Disinfectant/Disinfectant.rsrc/STR#_207.txt

Text File | 1994-04-02 | 8.0 KB | 358 lines







.



.





åProtection





The Disinfectant application by itself will not protect your system against

infection. It will only locate and repair previously infected files and disks.

To protect your system against infection, you must install a protection

extension (protection INIT).



Disinfectant includes such a protection INIT. When properly installed, it

will protect your system against all of the known non-HyperCard

Macintosh viruses.



WARNING: The Disinfectant protection INIT will not protect your system

against unknown viruses! If a new virus appears, we will have to release

a new version of Disinfectant to recognize it.



Use the “Install Protection INIT” command in the “Protect” menu to

install the Disinfectant INIT in your currently active Extensions folder

(under System 7) or in your currently active System folder (under

System 6). You must restart your Macintosh to activate the INIT.



Use the “Save Protection INIT” command in the “Protect” menu to save

a copy of the Disinfectant INIT to any location of your choosing.



The Disinfectant INIT is simple, small, efficient, and unobtrusive. It does

not need to be configured. In fact, it has no control panel interface at all,

so it cannot be configured. The INIT will never ask you to make a decision.

It should have no noticeable effect on the performance of your Mac. It is

very small and can easily be used on floppy startup disks (e.g., in

university labs with floppy-only Macs). The INIT does not interfere with

the normal operation of Disinfectant or other anti-viral applications, or

with programming environments, installer applications, or other system

software.



An alternative to the Disinfectant INIT is Chris Johnson’s excellent

Gatekeeper protection INIT. Gatekeeper is a “general purpose suspicious

activity monitor.” Unlike the Disinfectant INIT, Gatekeeper checks not

only for the known viruses, but also for suspicious activity characteristic

of viruses in general. Thus it can often provide protection against even

unknown viruses. Gatekeeper requires some configuration and it will

sometimes ask you to make complicated decisions. It is much more

powerful than the Disinfectant INIT, but it is also larger, more

complicated, more obtrusive, and harder to use than the Disinfectant INIT.



It is important that you understand this difference between the

Disinfectant INIT and Gatekeeper. There is an unavoidable tradeoff

between simplicity and power. Each individual must decide which kind of

protection is best for his or her particular situation.





If you run an application which is infected by one of the known Mac

viruses, the Disinfectant INIT beeps ten times, quits the application, and

presents an alert. For example, if the application “MacWrite” is infected

by the nVIR virus, the following alert appears when you try to run

MacWrite:




"


"



"


"


"


"


"


"


"


"


"



"





The Disinfectant INIT only detects and blocks viruses; it does not remove

them. To remove a virus, you must use the Disinfectant application.



With System 6, if you use a disk which is infected by the WDEF virus or

by the CDEF virus, the Disinfectant INIT beeps ten times, presents an

alert, and temporarily neutralizes the virus. You can safely use the disk;

the virus will not spread. To remove the virus from the disk, you can

either rebuild the Desktop file or use the Disinfectant application.

Rebuilding the Desktop file is usually easier.



If you use a HyperCard stack which is infected by the MacMag virus, the

Disinfectant INIT beeps ten times, presents an alert, and temporarily

neutralizes the virus. You can safely use the stack; the virus will not

spread. You should use the Disinfectant application to remove the virus

from the stack.



If you have an INIT file which is infected by the INIT 1984 virus, when the

virus attacks during startup, the Disinfectant INIT beeps ten times, and an

alert is presented at the end of the startup sequence. The virus is

neutralized and does not spread or cause any damage, but the non-viral

part of the infected INIT runs as usual.



The name of the Disinfectant INIT begins with a special invisible

character. This special character does not appear in Finder windows. In

standard file dialogs and in some other contexts, it appears as a box.



The special symbol is present to force the Disinfectant INIT to be the first

INIT loaded when you start up your Macintosh. This is important: the

Disinfectant INIT should be loaded first! If you rename the INIT, make

certain that you rename it so that it comes first in alphabetical order in

your Extensions folder or your System folder. With System 7, be very

careful to leave the INIT in the Extensions folder. Do not move it to the

System folder proper or to the Control Panels folder. To avoid problems,

we recommend that you do not rename the INIT.



The reason the Disinfectant INIT should be loaded first is to properly

detect and block the INIT 1984 virus, which spreads from INIT to INIT at

startup time. If the Disinfectant INIT does not load first, and if some

earlier INIT is infected by the INIT 1984 virus, then the Disinfectant INIT

will not be able to detect or block the virus when it attacks during

startup.



A number of other popular INITs also have the requirement that they

should be loaded first. Before installing such an INIT, scan it with the

Disinfectant application to make certain it is not infected by the INIT 1984

virus or any other virus. Then install it. Depending on how the INIT is

named, it may load before or after the Disinfectant INIT. Don’t worry if

the other INIT loads first. You have already made certain that it is not

infected, so it shouldn’t cause any problems.





The Disinfectant INIT icon should appear at the bottom of your screen

every time you restart your Macintosh. If an error occurs and the INIT

cannot load properly, the INIT will beep ten times and it will draw a

special error version of the icon (the normal icon with a large “X”

superimposed.)




#


#



#


#


#


#


#


#


#





The Disinfectant INIT icon normally appears first in the row of INIT icons

which appear when you restart. One exception to this is under System 6

with Apple’s Communications Toolbox installed. The Communications

Toolbox icon may appear first, in which case the Disinfectant INIT icon

appears second.



If you wish to remove the Disinfectant INIT for some reason, open your

Extensions folder (under System 7) or your System folder (under System

6) and drag the INIT icon to the trash (or anywhere else outside of the

System folder). Then restart your Macintosh.



Contrary to the instructions found in many software manuals, it is not

necessary to remove the Disinfectant INIT when installing software.

There are no known cases where the Disinfectant INIT interferes in any

way with installers.



The Disinfectant INIT detects and blocks viruses at their initial point of

attack. Unlike some other virus protection INITs, it does not scan floppies

each time they are inserted into a disk drive and it does not scan files

each time they are opened. This strategy is what makes the Disinfectant

INIT so small and efficient.



The Disinfectant INIT will not detect files which are partially infected but

not contagious, since these kinds of infections never attack the system.

These non-contagious infections are harmless, so this is not a major

problem. The Disinfectant application does detect these kinds of infections.



There are many different virus protection INITs available, including the

Disinfectant INIT, Gatekeeper, and several commercial products. In

general, we do not recommend that you use more than one of them at a

time. We are not aware of any serious conflicts between the Disinfectant

INIT and these other INITs, but using more than one of them usually does

not significantly increase your protection and often causes confusion.