Newsgroup: it.comp.macintosh
Titolo: Mac virus undetectable

We, TBWA/H Nethwork have a very nasty virus. We don't know were it comes
from but it is infecting all the Apple mac's. The symptoms are:
- hidden system folders
-hidden other folders
-renaming of folders and programs like QuarkXpress/Photoshop
-renaming of data-files
The result of this is that we cannot use the macs or have to reinstall them
every time they are infected.
The virus is probably related to the press release about Microsoft putting
money into Apple because the renaming is like:
-"Bill says 'No more macs'"
-"Bill says 'Apple back off'"
-"Bill says 'Windows rules"
-"Bill says 'Next week more fun'"
-"Bill says 'Buy a nice pentium PC'"
-"Bill says 'watch your server ya'"
etc. etc. all related to mr. "Bill" (G?? !!)
For now there is now scanner available to clean and detect it !! We've
contacted McAfee and Symantec to help us out.
For the near future: BE AWARE OPENING FILES FROM INTERNET !! 
The little info we have:
It's probably a script virus, about 5K, found on a Hotline server, which is
messing around in the Finder program. If anyone knows about those kind of
virusses please contact us:
RMe...@tbwa-europe.com
If we know more we will contact you. If anyone knows or hears anything
about this virus PLEASE CONTACT US A.S.A.P.
Robin Mesman
TBWA/H Nethwork

Hello Robin,



RMe...@tbwa-europe.com

Robin Mesman
TBWA/H Nethwork<<
Thanks very much for posting.  New information will be posted here as
soon as it is available.
--
Gregory Freeman
Macintosh Technical Support
Online Services, Symantec Corporation
Please post all questions to the public discussion group as Symantec
does not provide support via private Email.  Thank you.
US Support: 
541-465-8440
European Support: 31-71-5353-111
Australian Support: 61-2-879-6577
For FAQ documents: 
http://www.symantec.com/techsupp/faq/index.html
 

 wrote:

-- 
Is Windows a Virus?
No, Windows is not a virus. Here's what viruses do:
1.They replicate quickly - okay, Windows does that.
2.Viruses use up valuable system resources, slowing down the system as they
do so - okay, Windows does that.
3.Viruses will, from time to time, trash your hard disk - okay, Windows
does that too.
4.Viruses are usually carried, unknown to the user, along with valuable
programs and systems. Sigh... Windows does that, too.
5.Viruses will occasionally make the user suspect their system is too slow
(see 2) and the user will buy new hardware. Yup, that's with Windows, too.
Until now it seems Windows is a virus but there are fundamental
differences:Viruses are well supported by their authors, are running on
most systems, their program code is fast, compact and efficient and they
tend to become more sophisticated as they mature.
So Windows is not a virus.
It's a bug.

begin 644 Virus
Here's a bit of info to save you all from downloading the "virus" posted on
the newsgroups listed in the header of this message. A 10-minute analysis
of the attached file revealed:
1) When unstuffed, it consists of three items: (1) an empty folder labeled
"Kijk uit!" (Dutch for "watch out!"), (2) an empty folder labeled "VIRUS!"
(3) an application with a DocMaker icon pasted on it labeled "How to hack
Hotline Servers". The empty folders are indeed empty: a search for
invisible items returned a null.
2) The application has a file type of APPL and a creator of NONE. (That's
right, the letters N-O-N-E, not just an unknown file type.) Opening it with
ResEdit suggests that it was created with AppleScript, and that it asks you
for the location of your System Folder. (A better AppleScript programmer
would be able to find it automatically!) I didn't run the app, for obvious
reasons, so I don't know what it does from there.
BTW: Technically, it's a Trojan Horse, not a virus.
---
Tom Geller, Mac Product Consultant     *            
http://www.tgeller.com
Product criticism  *  Market analysis  *  Press relations  *  Partnerships
NOTE: Respond to 
t...@tgeller.com
. Pacbell.net is a temporary address.

 -"Bill says 'watch your server ya'"
Very interesting. How does it manage to create file names longer than
the Finder will allow? Sounds like BS to me.
Peter Spomer

Well, this is definitly not a hoax, just download the virus i posted in
earlier postings and run the App !
You will have all named folders and you will be missing yer system folder ! !
But it's not a virus as i said B4, it's an apple script written by some1
who doesn.t have real programming skills (otherwise the script would not
ask for locations)
NYWZ it dous do damage to yer Hard Disk, not just a few folders missing but
also some other hidden files that will becomne active when.....(dunno that
yet)
Greetz
Edo


-- 


,
luc...@telebyte.nl
 (Edo Knoppert) wrote:


 It's a bug.
Another difference between Win and viruses is the dimension of the
files.
Viruses are normally small programs, Win95 use at least 80Mb of your hd,
and wait, Win98 will need the double...
You are right. Windows is a bug.
Andrea
P.S. small filological question: viruses or viri? 

Finger 
sct...@xs4all.nl
 for PGP Public Key.
Boy, there's an old FAQ come back to life. As was said in older discussions,
the word "virus" was made a word in it's own right, and therefore follows
standard English pluralisation forms... ie. plural is "viruses".
Check up on DejaNews for the old discussions. I've never read the FAQ for the
newsgroup, but I presume it should have some brief mention about the
whole pluralisation issue.
--
Paul Gilbert           | 
p...@yallara.cs.rmit.edu.au
Bach App Sci, Bach Eng | The opinions expressed are my own, all my own, and
Year 4, RMIT Melbourne | as such will contain no references to small furry
Australia	       | creatures from Alpha Centauri.

 wrote:
: > if people use virii or some other neologism, as long as
: > they don't claim spurious academic authority.
: virii a neologism ?? :-DDD
I doubt if it's more than, say, ten years old, and probably less. I'm
open to correction, though: otherwise, I'd never dare open my mouth
in alt.comp.virus......
-- 
David Harley                     \   |   /                 alt.comp.virus FAQ
D.Ha...@icrf.icnet.uk
            \  |  /               & Anti-Virus Web Page
Support & Security Analyst         \ | /         Folk London On-Line gig-list
Imperial Cancer Research Fund   ____\|/____   
http://webworlds.co.uk/dharley/

That's the reason because Italy became a colony of every other state.
Anyway, from what I remember from school, the latin word "virus" had no
plural form: they used "venena" instead. The term "viri", with one single
"i" is the plural for "vir", that is "man".
Luigi
To get random signatures put text files into a folder called ÒRandom SignaturesÓ into your Preferences folder.