From: werner@rascal.ics.utexas.edu (Werner Uhrig)
Newsgroups: comp.sys.mac.system
Subject: CODE 252 - urgent new virus warning.
Date: 17 Apr 1992 13:24:34 -0500
Organization: CS Dept, University of Texas at Austin
Reply-To: werner@rascal.ics.utexas.edu (Werner Uhrig)
NNTP-Posting-Host: cs.utexas.edu
Summary: installation of GateKeeper should be considered by all Mac-users NOW


	a new Macintosh virus has been "caught" and "dissected",
	and was given the name "CODE 252".

	a more detailed announcement about it and anti-viral updates
	will follow shortly.

	updates for all the anti-virals are in the pipeline and
	most will be released later today.

	Whereas the initial analysis of the virus did not indicate
	that its structure was cause for (great) alarm, it has
	now been confirmed to me that its (mis)behavior may well
	be the cause of a lot of trouble reports I have seen lately,
	which seem to indicate corrupted System files.

	The virus makes an attempt to bypass the SAM protection,
	but is not succesful in a majority of cases, but rather
	will set off SAM's alarms (so if SAM-users have seen
	new alerts lately, you may have been "visited")
	It infects both Applications and the System file, and
	it is in the infection of the System file that it can
	corrupt it in a way that can cause crashes, either at
	boot up or later.  If you have seen such happening lately,
	it is a possibility that you have to replace your System
	file (if you do not know about such things in some detail,
	you may have to reinstall from distribution floppies).

	The only anti-viral which will reliably stop it from spreading
	AT THIS TIME (until updates are announced) is GateKeeper, and
	I recommend at this time that anyone with problems should
	install the latest version of GateKeeper (Vn 1.5.1+) *NOW*
	(it was just recently distributed in comp.binaries.mac and
	is FTPable from RASCAL.ICS.UTEXAS.EDU in binary format, in
	the directory mac/virus-catchers, and in binhex format from
	MICROLIB.CC.UTEXAS.EDU in the directory microlib/mac/virus;
	many other FTPable sites also have it available)

	Given that GateKeeper reports not only all KNOWN viruses,
	but ALSO (what it considers) SUSPICIOUS BEHAVIOR, be advised
	(read the docs) that GateKeeper may complain about some
	activity on your computer which is permissable (and until
	you have recognized those in YOUR particular environment,
	you may have to add some things to the GateKeeper permissions
	list, to avoid warnings which are not caused by a virus
	infection)

	If, like me, you normally keep GateKeeper installed always
	in NOTIFY-ONLY mode, you probably would have also already
	noticed (and acted upon) any reported attempts to modify
	the System file (which is the ONE indicator that everyone
	infected by the virus is likely to see, and which should
	cause you to investigate whichever program is doing this).
	In any case, I recommend that you switch GateKeeper mode
	to NOTIFY & VETO now, and reboot and exercise some of the
	applications that you most often use, to see if any cause
	alerts of attempted modifications which seem  "unreasonable"
	(it may also be a good idea to move the System file out
	of the System folder, and replace it with a back-up
	copy -- I routinely always make a copy of the System file
	after an installation, keep it around in stuffed format,
	for just such occassions.  One caveat, however, if the
	System file backup was never used together with the 
	latest Tune Up extension:  the first time it is booted,
	Tune Up WILL modify the System file, so don't let that
	one surprise or alarm you (once you see GateKeeper veto it,
	simple modify GateKeeper's permissions appropriately - read
	the docs - and reboot; that should take care of that one,
	at least, and is a good exercise to familiarize yourself
	with GateKeeper management anyway ..;-)

Removal of the virus:  Disinfectant neither notices nor can remove
	this new virus and, currently, I believe that only GateKeeper
	can stop its spread reliably, but cannot remove it from an
	infected application (that will require a new release of
	GateKeeper-Aid). But the important thing at this time, is
	for you to become aware of the infection, should you have
	it. And to stop the spread.  I will post updated information
	about all anti-virals shortly.

I apologize in advance for any errors or unclear advice, but
I hope to be able to provide better thought out information shortly.
do not flood me with question or request for advice today, though,
I am likely to ignore it, but may get helpers to respond back to you
later.  But this is not a good weekend, Easter and all, and many
helpers are travelling to attend a conference next week.

			Regards,		---Werner

----
Internet:	werner@rascal.ics.utexas.edu
BITnet:		werner@UTXVM
UUCP:     ...!uunet!cs.utexas.edu!werner
AppleLink:	werner@rascal.ics.utexas.edu@Internet#
-----
	One Moonbeam is worth MORE than a thousand points of light!
	(and several "...but I never inhaled...")

RIP:  Isaac Assimov (1919-Aril 6, 1992)

Newsgroups: comp.sys.mac.system