This is getting depressing. Two new viruses have appeared in Ithaca (kudos to Don Lee, a student computer supervisor at Cornell for first identifying them), one a simple clone of the MDEF virus, the other a take-off on the irritating WDEF.

The first virus, MDEF B (Top Cat) is exactly the same as MDEF A (Garfield) except that it can bypass the protection afforded by the Vaccine INIT. Vaccine should not be used any more since so many of the viruses circumvent its protection and since it will never be updated. Instead, use either GateKeeper and GateKeeper Aid or the Disinfectant INIT. If you're rich, the commercial programs have their uses as well.

The second virus, CDEF, works in the same basic way as WDEF does, copying itself into the invisible Desktop file whenever possible. It won't infect any other files, but it spreads so rapidly that it is a threat by its presence alone. Unlike WDEF, CDEF is a bit more solid and won't cause as many problems, but it's still not the sort of thing you want hanging around even though it doesn't actively cause damage. Like WDEF, rebuilding the Desktop file (hold down command-option when booting or when quitting an application under the Finder) will remove the CDEF virus. Also like WDEF, the CDEF resource is a valid Macintosh resource, but there should never be any CDEF or WDEF resources in the Desktop file.

These viruses irritate me because they show, as did the nVIR clones, that there are a lot anti-social types out there with nothing better to do than make others' lives more difficult. The whole situation reminds me of a quote from Monty Python. "Yes well, that's the sort of blinkered, philistine, pig ignorance I've come to expect from you non-creative garbage." In other words, if you're even considering writing a virus, get a real life. I'll be really interested to see what Cornell does if the author of some of these viruses is found.

In any event, there is a new version of Disinfectant out, version 2.1, to combat these viruses. Version 2.1 also corrects a few errors in version 2.0, including incompatibilities with A/UX 2.0, Icon-It!, Spy!, SuperClock, and Rival. We haven't been able to test the viruses ourselves, but GateKeeper and GateKeeper Aid (which is now at version 1.02) should also catch these new ones.

Information from:
John Norstad -- jln@acns.nwu.edu
Adam C. Engst -- TidBITS Editor