Topics How to use helpKnown Viruses G D┴T└hese are the known Macintosh viruses. Click a virus name for more ! information:Ç2┬Anti├ Ç É┬INIT 17╛┬SteroidÇ@%┬CDEF(Latest info)É┬INIT 1984«┬ScoresÇN┬ChinaTalkÇ É┬INIT 29╛┬T4Ç\┬Code 252Ç É┬INIT MÇ √┬T4-CÇj ┬CProÇ É┬MBDF AÇ √┬TetracycleÇx#┬DukakisÇ É┬MDEF B(C,D)¥┬Virus InfoÇå ┬FontFinder║┬MerryXmas⌐┬WDEFÇö┬FrankieÇ É┬MosaicÇ √┬ZUCÇó┬HC VIRUSÇ É┬nVIR ╛ GTo return here from a virus description page click ≡ Ç (at the top of ╦ the SAM Help Window). Θ&┼How to Update SAM ╒s Known Virus List ≈ ?├Symantec└ is committed to keeping your Macintosh virus free by Boffering you many ways to stay updated in the battle against viral
infection:! H Ñ└ As a registered├ SAM└ owner in the U.S. or Canada, you automatically/ Freceive a Virus Alert postcard any time a new virus is discovered. The= FVirus Alert contains the printed codes for a virus definition that youK Henter into the user (virus) definitions file to detect the new virus andY Fprevent it from contaminating your software (this method only detects,g Jnot repairs the virus. For that, you need a new Virus Definition file. Seeu ?the Download information below). International customers shouldâ .contact their local dealer or Symantec office.æ ├orƒ GYou may elect to sign up for one of our subscription services where you¡ Dautomatically receive a virus definition disk anytime a new virus is╗ Fdiscovered. Each update disk is SAM Installer-compatible and contain a╔ Jvirus definition and a description of the virus that is added to SAM Help.╫ 5To enroll in the US or Canada, call├ (800) 428-6800└.σ EInternational customers should contact their local dealer or Symantec≤ Ioffice for information on subscription services available in their areas. ├or B Ñ└ Download an updated SAM Virus Definitions file from one of the following on-line services:+ -├ CompuServe9$Go:├ SYMVIRUSG$Enter library├ 2U$File name:├ SAMDEFc -├ AppleLinkq$Path:├ Software SamplerH├Third Party UpgradesìH├Software Updates¢H├Companies S-Z⌐H ├Symantec╖$!File name:├ SAM Virus Definitions┼ -├ America Online╙$Keyword:├ Symantecß$Enter the software library∩$!File name:├ SAM Virus Definitions
7├Other services available to users in the US and Canada ├include:& C Ñ└ Obtain individual update disks from Symantec (as needed). Call├4 ├(800) 441-7234└.B ├orP < Ñ└ Call the Virus Newsline├ (310) 828-5344└ or the Symantec^ 6Faxline├ (800) 554-4403└ for user definitions updates.l ├orz J Ñ└ Dial in and download a user definition file from the Symantec Bulletinê Board System (BBS) at:û -├ (408) 973-9598ñ ├- (408) 973-9834 (9600 baud)▓ ├or└ 8As you can see, we ╒ve got you covered. Choose the virus╬ Ddetection/prevention update method that works best for you and stick▄ with it!≈ =Ask about our other fine products for your Macintosh such as: #├- Norton Utilities for Macintosh└. +├- Symantec Network Installer for Macintosh! #├- Norton Essenstials for PowerBookDR TopicsCPro CDiscovered in Michigan on a BBS in January 1993,├ CPro└ is a Trojan Fhorse application going under the guise of an update to Compact Pro, a * !popular file compression program. E ├Infection Characteristics S BCPro141.SEA appears as a self expanding archive but is actually an a Capplication that causes certain damage to floppy disks. CPro141.SEA o Fattempts to format any disks that are currently mounted. CPro can only } Hsuccessfully format floppy disks that were mounted before or at the time ï CPro is open and running. Ñ ├Detection└: │ H Ñ└ SAM Intercept can detect CPro when scanning your disks or prevent it ┴ %from opening if you try to launch it. ╧ G Ñ└ SAM Virus Clinic detects CPro when scanning your disks for viruses. Θ ├Reparability: ≈ A Ñ└ Trojan horses should be deleted as soon as they are detected. DCPro141.SEA can be deleted using the├ Delete file...└ command in SAM Virus Clinic.! 4 Ñ└ Floppy disks damaged by CPro may be irreparable.DR TopicsCDEF(Latest info) EDiscovered in Ithaca, New York, in August of 1990,├ CDEF└ was written Eby the same author that brought us several strains of the MDEF virus. : E├Update:└ In February of 1993, a mutant strain of CDEF was discovered H Iin New York. The mutation varied so slightly that even a variant name was V deemed unecessary. q ├Infection Characteristics: <CDEF was not designed to be malicious but can cause problems ì Gnonetheless. It infects only desktop files (invisible files used by the ¢ DFinder). Because of this, it spreads from disk to disk very quickly. ╢ CAs with most desktop viruses, System 7 is immune to the CDEF virus. ─ JEven though CDEF can attach itself to the desktop file, it will not do any ╥ Edamage to your system. It can, however, spread to non-System 7 disks. ∞ ├Detection: · D Ñ└ SAM Intercept and SAM Intercept Jr. can detect CDEF infection at startup or at scan time. F Ñ└ SAM Virus Clinic detects CDEF or it ╒s known mutant variation when$ (you use Virus Clinic to scan your disks.> ├Reparability:L @You can remove CDEF by rebuilding the desktop file; however, SAMZ GIntercept has an auto-disinfect feature that automatically disinfects ah @desktop file infected with any virus that infects desktop files.DR Topics MerryXmas >Discovered in May of 1993,├ MerryXmas└ is a virus that affects HyperCard stacks only. : ├Infection Characteristics: H CMerryXmas was not apparently designed to be malicious but can cause V Gminor problems and annoyances to those using HyperCard. It infects only d FHyperCard stacks beginning with the Home stack. Once the Home stack is r 7infected, the virus spreads easily from stack to stack. ì DDue to an error in the HyperCard script (program code) the MerryXmas ¢ ;virus displays an error every time a new stack is infected. ╡ ├Detection: ├ F Ñ└ SAM Intercept and SAM Intercept Jr. can detect the MerryXmas virus ╤ at scan time. ▀ C Ñ└ SAM Virus Clinic detects the MerryXmas virus when you use Virus φ Clinic to scan your disks. ├Reparability: EYou can detect and remove the MerryXmas virus using SAM Virus Clinic.DR TopicsT4-C C├T4-C└, a strain or variant of the T4 (A,B) virus was discovered in CFebruary of 1993 at the University of Illinois in Urbana-Champaign. : ├Infection Characteristics: H EThe T4-C variant infects applications and System files on an infected V ?startup volume. When activated under System 6, T4-C immediately d Jattempts to alter the resident System file resulting in damage that causes r FINIT problems at load time (startup). Modifications of this code could Ç 2even cause your Macintosh to crash during startup. ¢ ANote: T4-C can cause damage to the System file under System 6. In ⌐ Iaddition, it attempts to modify applications stored on the startup volume ╖ @when they are opened, sometimes overwriting valid resources with ┼ infected code. ▀ ├Detection: φ G Ñ└ SAM Intercept and SAM Intercept Jr. detect the T4-C variant at scan √ time. G Ñ└ SAM Virus Clinic detects the T4-C variant when scanning your disks.# ├Reparability:1 GSAM Virus Clinic can successfully eradicate the T4 virus (and variants)? Dfrom your disks. However, even though the virus and its variants areM Jproperly eradicated, it is important to note that possible damage incurred[ Bby the System file and some applications cannot be fixed using SAMi software.ä BShould you experience such damage, re-install your System SoftwareÆ Aand application software from uninfected back-up copies after SAMá .reports the virus has been completely removed.DR TopicsINIT 17 FDiscovered in Canada in April 1993,├ INIT 17└ is designed to "trigger" Ithat is, to become active the first time the user restarts his machine on - Eor after October 31, 1993. At that time, a message is displayed in a ; Dwindow entitled "From the depths of Cyberspace". After showing this I Kmessage once on an infected Macintosh, the virus does not display it again. d ├Infection Characteristics r HINIT 17 infects the System file and application files. However, it will Ç 4not infect some applications including Virus Clinic. ¢ GAlthough not intended to be destructive, INIT 17 contains errors in its ⌐ Bviral code that may cause crashes, especially on older 68000-based ╖ -Macintoshes such as the Plus, SE and Classic. ╤ ├Detection└: ▀ F Ñ└ SAM Intercept and SAM Intercept Jr. detect INIT 17 during scans or φ 7when you try to run an application infected by INIT 17. √ F Ñ└ SAM Virus Clinic detects INIT 17 when you use Virus Clinic to scan your disks.# ├Reparability:1 L Ñ└ SAM Virus Clinic can repair files infected by INIT 17. However, if it is? Kpossible for you to do so, replace rather than delete applications infectedM by INIT 17.DR TopicsINIT M CDiscovered in April 1993,├ INIT M└ is a destructive virus which can Drename files and folders to random names or the virus may change the - JFinder ╒s type and creator information, clear creation, modification dates ; and times of affected files. V ├Infection Characteristics d @INIT M infects application and system extension (or INIT) files, r Freplicating only under System 7. If you are running under System 6 the Ç Cvirus does not spread. The virus also infects files located in the Ä EPreferences Folder (inside the System Folder)and creates a file named £ 'FSV Prefs but cannot spread from there. ╢ GAlthough INIT M can actively reproduce anytime, the virus only triggers ─ Gif your Macintosh is running on any Friday the 13th. At that time, the ╥ Hvirus does its damage, changing names, types and creators of your files. ∞ HIt has been noted that INIT M can sometimes change folder and file names · to ╥Virus MindCrime ╙. ├Detection└:" E Ñ└ SAM Intercept and SAM Intercept Jr. detect INIT M during scans or0 ;when you try to launch an application infected with INIT M.> J Ñ└ SAM Virus Clinic detects INIT M when you use Virus Clinic to scan yourL disks.f ├Reparability:t K Ñ└ SAM Virus Clinic can repair files infected by INIT M. However, if it isé Kpossible for you to do so, replace rather than repair applications infectedÉ
by INIT M.DR Topics New Virus New virus info goes here.
