Abstracts from files in info-mac/vir as of Sun 20 Mar 2005


#### TEXT       00what-to-use.txt   ****

Here are our current recommendations for virus-related tools. Such tools can
be divided into three classes: those that prevent infections, those that warn
you when an infection is present, and those that remove infection. This
message only discusses non-commercial software.


1. Prevention

   Two excellent tools for prevention of viral infections are the Disinfectant
extension (distributed as part of the Disinfectant application) and
the Gatekeeper package.

   The Disinfectant extension is very easy to install and requires no
user configuration. However, it is important to stay up-to-date with this
tool, because it only recognizes viruses it has been taught about.

   Gatekeeper is an effective virus-prevention method for the more
technically inclined. It requires some customization to work well in a
particular environment. The benefit of Gatekeeper is that it provides
some protection against some possible kinds of future virus, not just

#### TEXT       a-toast-to-disinfectant.txt   ****

From: bmunday@tecnet1.jcte.jcs.mil
Date: Thu, 29 Sep 94 13:51:40 EDT
Subject: Disinfectant: A Toast (Summary)

To the moderators:

This is a summary of the two files in the \info-mac\vir\ subdirectory
entitled "a-toast-to-disinfectant.txt"
     and "a-toast-to-disinfectant-pt4.txt".

It combines the two files into one, and I have also removed a lot of
padding with spaces that somehow crept into the subfiles.  As a result,
this file is only 48k while the two subfiles total 72k.  This should reduce
(a little bit, at least) the required disk space.  Please remove the two
older files for me.  Thank you.

To everyone else:  This is a complete summary of the 95 messages I received
in response to my request for messages thanking John Norstad and all the
other folks who have helped with Disinfectant over the years.  Thanks to
everyone who wrote; John sent me his thanks for the mailing, which I pass

#### BINHEX     alternate-sam-35-install.hqx   ****

From "gt3017c@prism.gatech.edu (William Homer Waits)" Tue Aug 24 17:03:34 1993
Date: Mon, 23 Aug 1993 22:55:39 -0400
From: gt3017c@prism.gatech.edu (William Homer Waits)
Subject: SAM Installer Scripts


In response to some complaints on the Internet
regarding the un-intuitive installer script for
Symmantec's popular virus program SAM* 3.5.  
Symmantec's script will not do an installation
if you have replaced the original Virus Definition
file.  Go figure!  I don't know about you, but I
update mine when necessary on the original disks.
I have created my own scripts which should work
fine.  I have System 7.1, and I know it works there,
but I also have created a System 6 installer.  It
should work fine, but I have no place to test it.
Only the target folders have changed.  These scripts
only recognize the Virus Definitions file on the
Decontamination Disk, so make sure that is where
you place your updated Definition file.

If you decide to use these, please just e-mail me
and let me know that you have used it.  Also, let
me know about any troubles you may have.  I can be
reached at the following addresses:

gt3017c@prism.gatech.edu (until 6/94)

or

Heathen@aol.com

SAM* is copyrighted by Symmantec Corp.  I have
no affiliation with them.

Al Bloom, this one's for you!


#### BINHEX     antigax-13.hqx   ****

From: s2191331@cse.unsw.edu.au
Subject: Graphics Accelerator Antivirus program

AntiGax is a free program which detects and repairs files infected by the
recent 'Graphics Accelerator' virus (also known as SevenDust-E and 
MDEF-9805-E).

This archive also includes GAx Defender, which is an extension that checks
programs for the virus as you run them.

Instructions on their use are in the readme - please read it.

More information is available on the web at this address:
<http://www.cse.unsw.edu.au/~s2191331/antigax/antigax.html>


{P^/

John Dalgliesh
s2191331@cse.unsw.edu.au



#### BINHEX     autostart-worm-cleaner-lite.hqx   ****

From: tnharris@iname.com
Subject: Autostart Worm Cleaner lite 98/05/22


Autostart Worm Cleaner lite
===========================
Release 98/05/22
Version 1.0.1

The Autostart Worm Cleaner lite is an Applescript that removes known
autostart worms. This release recognizes:
  - Autostart worm 9805
  - Autostart worm 9805-B
  - Autostart worm 9805-C

The script requires the scripting additions Jon's Commands and
Processes (part of Script Tools). It should run on any system with
AppleScript installed.

Copyright 1998, Tom N Harris
<mailto:tnharris@iname.com>
<http://www.cfw.com/~etienne/mac/>





#### BINHEX     bscan-2.hqx   ****

From: mark@mrdataworks.com
Subject: BugScan 1.0b1 Revision


BugScan 1.0b1

October 23, 1998

BugScan is freeware - by downloading this file, you agree to use it at your own risk.

This application was mainly designed for our clients to determine if they do in fact have the AutoStart and Graphics Accelerator files on their hard drives. These viruses have become real pests for many of us. Make sure you use Virex or Norton Anti Virus if you get a red light (and then call your local computer consultant). If you get a green light, bonus! If you don't own one of these applications already, make one of them your next purchase.

BugScan will detect all files for all strains of the AutoStart 9805 Worm current at 10/23/98 as well the Graphics Accelerator Extension (GAX). BugScan will also detect any combination of these files. Click BugScan's 'Help' button to read more about the viruses themselves.

We strongly recommend that you restart your Mac with extensions off (holding down the 'shift' key) before running BugScan. You can now restart your Mac from directly within BugScan if needed.

BugScan gives you two scanning options:

Quick Scan Method

Checks for AutoStart and Graphics Accelerator files in their exact locations on the selected volume. This method does a top level scan and a system level scan on the selected volume (a system level scan is performed only if there is a System Folder on the selected volume).

Full Scan Method

Checks for AutoStart and Graphics Accelerator files in all locations on the selected volume - in other words, everywhere. Note that the full scan method takes much longer and even longer yet when scanning network volumes. This is, however, the recommended method.

BugScan gives you three menu options:

Install 9805 Defense

Creates invisible, locked folders in the appropriate locations on your startup disk to combat the AutoStart 9805 Worm.

Install GAX (Graphics Accelerator) Defense

Creates an invisible, locked folder in the Extensions Folder on your startup disk to combat the Graphics Accelerator Virus.

Open QuickTime Control Panel

Opens the QuickTime Control Panel and prompts you to turn the "Enable CD-ROM AutoPlay" function off. BugScan quits immediately after opening the Control Panel.

If BugScan locates any virus applications and/or virus reference files, BugScan will attempt to remove them. If any of the files are already in use (infecting your hard drive), BugScan warns you and prompts you to delete them manually. BugScan will do its very best to make any invisible files visible and to move all these files to the trash. If this is not necessary, the files will be deleted but you'll still need to do a proper virus scan to see if the rest of your Mac has been infected. Hopefully not.

Running BugScan does not make your Mac instantly 'safe'! Everyone needs to practice "safe computing" from now on!

Remember to do a proper virus scan using Virex or Norton Anti Virus. The bad news is that if you've been infected for some time now, you'll probably be looking at a complete reformat and re-install. The best advice we can give you is to get on this ASAP.

We do not provide free technical support for freeware (nor free technical support for virus-hunting, troubleshooting and maintenance).

Good luck...

Long Live Apple!

© 1995 - 1998 Mountain Ridge Dataworks
WWW: http://www.mrdataworks.com/

Written By Mark Weston




#### BINHEX     disinfectant-371-it.hqx   ****

From: rotunno@wyvern.it
Subject: disinfectant 3.7.1 Italian


disinfectant 3.7.1 italian


From: Rotunno@wyvern.it
Subject: disinfectant 3.7.1 italian


Italian localized version of this famous antivirus for Macintosh.
Official translation made by: Rotunno@Wyvern.it.
See included read me files for details.



#### BINHEX     disinfectant-371.hqx   ****

From: j-norstad@nwu.edu
Subject: Disinfectant 3.7.1


Disinfectant 3.7.1 is a new release of our free anti-viral utility for the
Macintosh.


3.7.1 Release Notes (July 9, 1997)
----------------------------------

Version 3.7.1 fixes an error which could sometimes cause crashes when
scanning very rare kinds of files while pass the new "more lenient"
check for damaged resource forks which was introduced in 3.7.


3.7 Release Notes (July 7, 1997)
--------------------------------

Version 3.7 detects a minor variation of the MBDF B virus which was
properly detected by the 3.6 INIT but not by the 3.6 application.

The Disinfectant manual now discusses the Microsoft macro virus problem.
The introductory text displayed in Disinfectant's main window warns that
Disinfectant does not recognize the macro viruses and refers the user to
the manual for more details.

The "All Disks" command in the "Scan" menu has been changed to "All
Local Disks". This command now only scans local disks, not network
AppleShare servers.

The "All Disks" command in the "Disinfect" menu has been changed to "All
Local Unlocked Disks". This command now only disinfects local unlocked
disks, not network AppleShare servers or locked disks like CD-ROMs or
locked floppies.

If you want to scan or disinfect servers, scan or disinfect them
individually, or use the "Some Disks" commands in the "Scan" and
"Disinfect" menus.


--
John Norstad
<mailto:j-norstad@nwu.edu>
<http://charlotte.acns.nwu.edu/jln/>



#### BINHEX     eradicator.hqx   ****

From: ericsson@interlog.com
Subject: Eradicator kills new Mac worm. Freeware.


Eradicator v.1.0.1 is freeware which removes the new Mac worm Autostart
9805. It is released as a service to Mac users by Hong Kong IT company
Uptown Solutions Ltd.

Autostart 9805 infects PPC Mac OS systems (7 & 8) with QuickTime 2.0 or
above and with mounted HFS or HFS+ volumes and CD-ROM AutoPlay enabled. It
adds invisible files to every disk partition and periodically causes
extensive disk activity (and network activity if network disks are
mounted). Will overwrite some data files with random data. The worm can be
transmitted via almost any HFS or HFS+ disk volume, including floppy disks,
most removable cartridges drives, MO disks, CD-WORM disks, hard disks and
even disk images. The worm will also spread across networks to any mounted
network file partition.

Although Autostart 9805 can be removed manually using a resource editor,
Eradicator was written to ease the process. Click the Scan button to start
scanning the mounted volumes. Eradicator will report what it finds in a
window. If it finds the virus on any of the mounted volumes, it will
attempt to fix it. If the attempt is successful, a placeholder will be put
in place so that your computer is immune to future infection.

3.1 Meg Stuffit file has full documentation. Swept with Disinfectant 3.7.1

Uploader hereby disclaims any responsibility for loss of data or other
damages resulting from usage of this file.




#### BINHEX     gatekeeper-130.hqx   ****

Date: Fri, 12 Nov 1993 16:38:22 -0600
From: chrisj@mbs.telesys.utexas.edu (Chris W. Johnson)
Subject: Gatekeeper 1.3 (yes, two in as many days)



--========================_36297202==_
Content-Type: text/plain; charset="us-ascii"

Gatekeeper 1.3 is a set of Macintosh system extensions (INITs)
and related control panels (cdevs) which, when active (i.e.
allowed to install themselves during the boot process) offer
protection against attacks by all known viruses (to the author
at the time of this release).

Gatekeeper also monitors computer activities for what are
considered to be suspicious 'events' or 'operations', in an
attempt to intercept what could be variants of known viruses or
even completely new viruses.

Since its initial release in January of 1989, Gatekeeper has
repeatedly demonstrated its ability to stop the spread of
viruses which were unknown during its design. Like any anti-
virus system, however, it cannot guarantee complete protection.

Of course, no claims or promises are made regarding Gatekeeper's
effectiveness or suitability, and some functions and capabil-
ities of Gatekeeper are non-trivial to use and may require a
careful reading of the documentation.


Gatekeeper 1.3 Release Notes 12-Nov-93
---------------------------------------------------

Gatekeeper 1.3 was created the day after 1.2.9 was released to fix
a bug that caused all pre-7 systems to hang during startup, and 
crashed some System 7.x machines.

For those of you wondering about the story behind the bug, and
why 1.2.9 missed its scheduled release date by three days, it's
pretty simple. When the new viruses appeared, I was in the middle
of work on a new and improved Gatekeeper which was going to be
version 1.2.9 in a couple of months. Unfortunately the work, while
mostly complete, still wasn't quite finished at the time those
viruses appeared. So I had to either (a) try to finish the new 
improvements very quickly, or (b) rip them all out and return,
more or less, to the functionality of 1.2.8. I went for option
'b'. Unfortunately, while I was ripping out the nifty new code, I
overlooked one file in one of the ten or so projects that currently
combine to form Gatekeeper. Consequently, some of that new code
which wasn't quite finished was built into one portion of version
1.2.9. Since it was mostly working, it passed all my in-house 
(actually "in-office" would be more accurate) tests prior to 
release, but failed when it finally met up with the real world.

Why didn't I just go back to the archived 1.2.8 source? Because
there were some bug fixes and various uncontroversial (but 
significant) improvements already in 1.2.9 which I certainly 
wanted to be part of any new release.

So, here's 1.3; use it in good health. Please delete any copies of
1.2.9 that you may have laying around and spread the word that 1.3
is available.

[Thanks, BTW, go to Brian Price for allowing himself to be 
 dragooned into running some last minute tests.]

----Chris



--========================_36297202==_
Content-Type: application/mac-binhex40; name="gatekeeper-13.sit"


#### BINHEX     good-times-virus-hoax-faq.hqx   ****

Date: Tue, 9 May 1995 12:29:23 -0400
From: lesjones@usit.net (Leslie Jones)
Subject: Good Times Virus Hoax FAQ 5/9/95

As you probably know, the Good Times virus is a hoax. The FAQ provides
answers to many questions about the hoax, gives a history, debunks some
myths, and points to some other sources of information. The FAQ also gives
directions for finding the two-page mini FAQ.


#### BINHEX     hyper-gatekeeper-127.hqx   ****

From: Wolfgang McKeown <mwolfg1@icarus.cc.uic.edu>
Subject: hyper-gatekeeper-127

HyperGatekeeper is an anti-viral stack for all known HyperCard script 
viruses.  It is designed to detect unknown viruses as well, but whether 
that will work or not depends on the individual viruses.

This stack has been tested with all the viruses I had on hand (for some 
reason, HyperCard viruses are hard to find; I had to write almost all of 
the test viruses myself).

I have tried to make this stack the best it can be, but then no security
is perfect.  Any suggestions or complaints are welcome.  (Please give a 
reason for your complaint, not just "I hate this thing; I'm not using it.")

This version (1.2.7) will detect viruses that try to evade HGK by 
unlocking a stack, infecting it, and then locking it again.  To prevent 
the annoying problem of having to answer modification dialogs on old 
stacks after installing a new version of HGK, this version includes an 
updater that will upgrade an installed (in the Home stack) copy of 
version 1.2.5.

Wolfgang McKeown  8-)


#### BINHEX     innoculator-10.hqx   ****

From: rmarasa@sprint.ca
Subject: Innoculator 1.0


Autostart 9805 worm scanner and cleaner. freeware.


#### BINHEX     mac-sig-95-02-02.hqx   ****

Date: Mon, 06 Feb 95 12:25:34 pst
From: "Matt Riley" <mriley@symantec.com>
Subject: MacSig 2/2/95.sea

Will update MacTools to find and clean the NVP trojan Horse.


#### BINHEX     mactools-antidotes-94-04-02.hqx   ****

From: "Chall Fry" <cfry@well.sf.ca.us>
Subject: Mac CPAV Antidotes 4/2/94
Date: 6 Apr 1994 14:47:25 -0800

Here's the MacTools CPAV antidotes file (aka MACSIG), dated 4/2/94.
This has the README file included, and is ready to be placed on FTP
sites. I'll also be sending this off to info-mac.

    --Chall Fry--
(Central Point Software)


#### BINHEX     mcafee-virus-scan-101.hqx   ****

From: (Raul Almquist) strider@shadowmac.org
Subject: McAfee VirusScan v1.0.1 for the Mac.

  Complete descriptive is included in the MacFile.ID textual descriptive 
file included in the archive.


#### BINHEX     merry-xmas-killer.hqx   ****

From LTAYLOR@CSBINA.CSUBAK.EDU Thu Sep  2 10:50:01 1993
Date: Wed, 1 Sep 1993 22:07:07 -0700 (PDT)
From: LTAYLOR@CSBINA.CSUBAK.EDU
Subject: "Merry Xmas" Killer


	I have recently experienced one of the most annoying Macintosh para-
sites of all time -- the virus.
	Although only a HyperCard virus, "Merry Christmas" is an annoying 
little bugger to have, like any virus. Fortunately, I was able to spot it
before it infected anything really important.
	I highly suggest that anyone with HyperCard download this file. It
will scan your stacks for Merry Christmas and permanently zap it. Although
small (less than 12K) it does its job very efficiently.

	Have fun with HyperCard!			*Stiles

============================= cut here =============================

#### BINHEX     merry-xmas-vaccine-32-hc.hqx   ****

From: BillDS@aol.com
Subject: merryxmas Vaccine 3.2

KEYWORDS: VIRUS MERRYXMAS VACCINE XMAS PICKLE ANTIBODY INOCULATE

This stack eliminates script based viruses which spread themselves by 
appending the scripts of other stacks with additional instructions which 
in turn infects every stack they come in contact with. The original virus 
of this ilk is called "merryxmas."

Since the appearance of merryxmas, other strains have surfaced such as 
merry2xmas, Lopez and others too crude to mention. merryxmas Vaccine 
catches them all-and it's FREE!

NEW in v3.2
----------
A well meaning merryxmas "antibody" has appeared. Unfortunately, while it 
may have good intentions, it is by definition a virus itself. It doesn't 
do any harm, but it does quietly insert itself into the Home stack and 
others in much the same way merryxmas does. Version 3.2 removes the 
antibody.
 
Requirements
------------
HyperCard v2.1 or later.
Color monitors (optional) will display "status colors."


#### BINHEX     merry-xmas-watcher-20.hqx   ****

Date: Tue, 28 Feb 95 10:05:21 PST
From: kdunham@eosc.osshe.edu (Ken Dunham)
Subject: merryxmasWatcher2.0.cpt.hqx

merryxmasWatcher2.0.cpt.hqx is a free HyperCard 2.1 stack that
scan and erradicates for the merryxmas and merry2xmas viruses.
The watcher script, which is installed in the Home stack of 
HyperCard, will watch stacks for you as you work.  By making
use of the watcher script you won't need to scan each new 
HyperCard stack - you can work freely without the fear of being 
infected.

You have my permission to include this in your cd-rom.

Ken Dunham, La Grande Middle School
kdunham@eosc.osshe.edu, kdunham@ednet1.osl.or.gov
Science and Math Education, Merryxmas Virus Killer, HyperCard Developer


#### BINHEX     rival-defs-9304b.hqx   ****

Date: 22 Apr 93 09:22 GMT 
From: NONE.FRED@AppleLink.Apple.COM (France - nOne Corp, F Miserey,IDV)
Subject: Re2: INIT-M Vaccine ready 

Bill,
 
Will you please post the above "INIT-M Vaccine" for Rival below.
 
Yours,
 
Frederic
------------

#### BINHEX     rudolph-20.hqx   ****

From: jinglis@flannet.middlebury.edu (Jeff Inglis)
Subject: Rudolph

Rudolph is an automated merryxmas and merry2xmas virus fighter. It can detect
and disinfect stacks infected with the merryxmas virus. Further, it inoculates
stacks against ever being infected. Rudolph is a major improvement over other
anti-merryxmas stacks in the following ways:
1) automated execution and quitting (runs unattended in "Startup Items" or
"Shutdown Items")
2) inoculation of stacks - prevent infection before it happens!
3) an option for single-file checking, disinfection, and inoculation (and not
just an entire volume)
Rudolph was created by Jeff Inglis and Jim Rodda, of the Middlebury College
Language Schools.
The merryxmas and merry2xmas viruses are HyperCard-only viruses.

Jeff Inglis


#### BINHEX     sam-install-scripts-12.hqx   ****

From: gt3017c@prism.gatech.edu (William Homer Waits)
Subject: SAM Install Scripts 1.2
Date: Sun, 9 Jan 1994 00:16:40 -0500


In response to some complaints on the Internet regarding
the un-intuitive installer script for Symmantec's popular
virus program SAM* 3.5.  Symmantec's script will not do an
installation if you have replaced the original Virus Definition
file.  Go figure!  I don't know about you, but I update mine
when necessary on the original disks.  I have created my own
scripts which should work fine.  I have System 7.1, and I know
it works there, but I also have created a System 6 installer.
It should work fine, but I have no place to test it.  Only the
target folders have changed.  These scripts only recognize the
Virus Definitions file on the Decontamination Disk, so make sure
that is where you place your updated Definition file.  Also, it
you are using System 7 or greater, SAM* Intercept and SAM*
Intercept Jr. are both placed in the Extensions Folder.

If you decide to use these, please just e-mail me and let me
know that you have used it.  Also, let me know about any
troubles you may have.  I can be reached at the following
addresses:

gt3017c@prism.gatech.edu

or

Heathen@aol.com

My snail mail address is

William Waits
1471 Ashwood Way
Lawrenceville, GA 30243

SAM* is copyrighted by Symmantec Corp.  I have no affiliation
with them.

Al Bloom, this one's for you!

Version History

    -1.0  Initial Release

    -1.2   Added better icons to custom window
             Read Me file reflects more accurate data


#### BINHEX     sam3-virus-defs-95-07.hqx   ****

Date:         Tue, 01 Aug 95 09:58:50 EDT
From: "Allan M. Bloom" <IRBLOOM@VTVM1.CC.VT.EDU>
Subject:      SAM 3.x Virus Defs 07/28/95

NOTE: this file is for SAM 3.0.x and SAM 3.5.x only.If you have SAM
4.0.x, then you'll need to download SAMDef.405. New Virus Definitions
with a new def added for the HC9507 Hypercard  virus.  This is
an .sea file. Download it.  Expand it.  Then drop these files  onto
the system folder and let them replace the files there now.
Restart to  verify that it is working correctly.


#### BINHEX     sam4-virus-defs-95-11.hqx   ****

From: "Allan M. Bloom" <IRBLOOM@VTVM1.CC.VT.EDU>
Subject: SAM 4 Virus Defs 11/95

This is the latest version (4.07, 11/22/95) of SAM virus definitions
for version 4 of SAM. Do not use with version 3.

Sorry, no equivalent for SAM-3 was on CompuServe's Symantec forum. The
below message from Stephen Zeffren explains the update.

Al Bloom

New SAM Virus Definitions file and SAM Help file for DETECTION ONLY of
  the new MSWord Macro Viruses.  Download this file, expand by double
  clicking on it, and then drop the two files onto your System folder to
  replace  the older files there now.  Restart and you're set.


#### BINHEX     scrooge-20-hc.hqx   ****

From: dickt@ucs.orst.edu (Thomas Dick)
Subject: Scrooge

Scrooge v2.0 kills the merryxmas hypercard virus and a good number of its
possible mutations.  Also at your option inserts "antibodies" into your
stacks so that they become "immune" to this virus.   The antibodies are
quite inert, but they may trigger other merryxmas virus detection
algorithms.   

There were never any bug reports from the old version, but it did contain
a, er... design flaw.  To depict graphically that the new version has a
better design, the icon has been changed from an elderly man to an elderly
woman.

This stack is free; It is provided as a public service.    Not as fancy or
powerful as some of the other merryxmas vaccine programs, but smaller.  Get
merryxmas vaccine AND Scrooge even if you don't think you're infected  to
maximize herd immunity from this annoying pest.  I hope the author of the
merryxmas virus comes down with terminal crab lice.   

Scrooge may be freely copied and distributed as long as you don't modify it.  

Send comments, bug reports re: this stack to dickt@ucs.orst.edu or
PlatySoft@aol.com
http://users.aol.com/platysoft/


#### TEXT       virex-viruses-detected.txt   ****

From: alanc@ocf.Berkeley.EDU (Alan Coopersmith)
Date: Wed, 14 Jul 93 09:29:53 PDT 
Subject: Virex 3.x Virus Definitions 


The following text file lists viruses detected by all versions of Virex since
1.0.  It also lists UDV codes for viruses discovered since version 3.5.  The
list came from the Datawatch forum on America Online.

Disclaimer: I have no relation to Datawatch/Virex other than being a
customer.  If you have any problems with Virex, please contact Datawatch
directly.

--------------------------------------------------------------------------
Alan Coopersmith			  Internet: alanc@ocf.berkeley.edu
U.C. Berkeley Open Computing Facilty      America Online (AOL): AlanC Utah
--------------------------------------------------------------------------

Virex Version Information and UDV Codes 
    for Recently Discovered Viruses

#### BINHEX     virus-reference-216-hc.hqx   ****

From: dpettit@Phoenix.kent.edu (Douglas Pettit)
Subject: VirusReference2.1.6

Virus Reference 2.1.6 Online Database of Macintosh Viruses

Virus Reference is a HyperCard based database of Macintosh viruses and trojan
horses. Includes search capabilities, and detailed descriptions of symptoms.

This update includes information on the Word Macro 9508 virus, recently
discovered.


#### BINHEX     virus-warning-20-hc.hqx   ****

From: Matthias Kahlert <matthias.kahlert@rz.fh-regensburg.d400.de>
Subject: Virus Warning, Version 2.0

An AntiVirus HyperCard Stack.

This stack helps you detecting and disinfecting your stacks, which may be infected with the
"Merry XMas" Virus. You also can install an active virus protection in your home stack.

For more information use:
   E-Mail: matthias.kahlert@rz.fh-regensburg.d400.de
   Internet: http://rfhs0002.fh.uni-regensburg.de/~s1830/hypercard_e.html

Thanks
   Matthias Kahlert, Regensburg/Germany, January 4th 1996


#### BINHEX     worm-guard-102.hqx   ****

From: clarence_locke@bellsouth.net
Subject: WormGuard 1.0.2


WormGuard is a freeware system extension that actively protects you from 
the AutoStart 9805 worm whenever a volume is mounted or a file is 
accessed by any application.  If the infection is found, it is 
automatically removed and you are notified of what happened via the MacOS 
Notification Manager.  Version 1.0.2 fixes the AppleShare file copy bug.



#### BINHEX     worm-scanner-201.hqx   ****

From: jwwalker@kagi.com
Subject: WormScanner 2.0.1 (an AutoStart worm remover)


This program scans your local drives for the AutoStart 9805 worm variants,
and will also alert you to unknown files with suspiciously similar
properties. It is based on published descriptions of the activities of
these worms. I have not
personally tested it on real worms.

Worms may lurk inside disk image files, but unless the disk image is
mounted, WormScanner will not be able to look inside.

WormScanner requires Color QuickDraw, meaning that it will not run on
machines that use the original 68000 processor.
-- James W. Walker  <http://members.aol.com/jwwalker/>



#### BINHEX     wormfood-15.hqx   ****

From: doug@null.net
Subject: WormFood 1.5


WormFood v1.5 October 24, 1998

Author: Doug Baer <doug@null.net>

Purpose: Scan for the AutoStart 9805 A-F strains and attempts to find new 
			strains. Features quarantine ability.

Version History:

10/23/98 - v 1.5 
* complete rewrite of the scan engine for increased speed and better
heuristics 
* no longer deletes files --> moves them to quarantine
* per user request, rebuilt with the FAT version of the MacPerl interpreter

WormFood was written in MacPerl 5.2.0r4 (17April98) by Matthias Neeracher.