According to a bulletin from Professor Gene Spafford of Purdue University, a new Macintosh virus was recently discovered by Mac users in Italy. This virus, dubbed "INIT-9403," has the potential to erase information on hard disks attached to infected computers.
The virus apparently was initially spread through altered versions of pirated commercial software. Once installed by the software, the virus alters the Finder, and may insert copies of itself in various data compression and archive applications. From there, the virus can spread to other Macs. After a certain number of files have been infected by a given copy of the virus, it erases disks connected to the system.
Although the virus has so far only been seen on Macs running the Italian version of the Macintosh operating system, it's important that all users upgrade their antiviral utilities to combat it and help prevent further spread. New versions of Central Point Anti-Virus, Rival, SAM, and Virex, the commercial entries in the Mac antiviral field, are already available and may be obtained from the vendors. Updates may also be available from company BBSs or the Internet. Antiviral updates are typically available in:
ftp://rascal.ics.utexas.edu/mac/virus/
Search strings for the new virus for use in Jeff Shulman's shareware Virus Detective will be sent to registered users. An update to Chris Johnson's free Gatekeeper package is anticipated by the end of this week.
John Norstad of Northwestern University quickly released version 3.4 of his popular freeware utility, Disinfectant, available at:
ftp://ftp.acns.nwu.edu/pub/disinfectant/ disinfectant34.sea.hqx
Norstad has since announced that a bug in 3.4 causes error messages to appear when the user scans the System Folder on a Mac using System 7.1 and System Enablers 003 (for the LC III) or 040 (for the Centris or Quadra 610, 650, and 800). He plans to release an update within the next several days, but assures users that the Disinfectant 3.4 application and protection INIT are effective against the virus. Users should ignore the error messages that appear when the Enabler file is scanned. The protection INIT has no known problems and can be used without fear of erroneous error messages coming up.
Users who typically get their antiviral utilities from the Info-Mac archive at <sumex-aim.stanford.edu> should use another site this time due to the deletion of files by an as-yet-unknown infiltrator (see above for details).
-- Information from:
Gene Spafford -- spaf@cs.purdue.edu
John Norstad -- j-norstad@nwu.edu