Download alternate-sam-35-install.hqx (7,340 KB)
From "gt3017c@prism.gatech.edu (William Homer Waits)" Tue Aug 24 17:03:34 1993
Date: Mon, 23 Aug 1993 22:55:39 -0400
From: gt3017c@prism.gatech.edu (William Homer Waits)
Subject: SAM Installer Scripts
In response to some complaints on the Internet
regarding the un-intuitive installer script for
Symmantec's popular virus program SAM* 3.5.
Symmantec's script will not do an installation
if you have replaced the original Virus Definition
file. Go figure! I don't know about you, but I
update mine when necessary on the original disks.
I have created my own scripts which should work
fine. I have System 7.1, and I know it works there,
but I also have created a System 6 installer. It
should work fine, but I have no place to test it.
Only the target folders have changed. These scripts
only recognize the Virus Definitions file on the
Decontamination Disk, so make sure that is where
you place your updated Definition file.
If you decide to use these, please just e-mail me
and let me know that you have used it. Also, let
me know about any troubles you may have. I can be
reached at the following addresses:
gt3017c@prism.gatech.edu (until 6/94)
or
Heathen@aol.com
SAM* is copyrighted by Symmantec Corp. I have
no affiliation with them.
Al Bloom, this one's for you!
Download antigax-13.hqx (41,009 KB)
From: s2191331@cse.unsw.edu.au
Subject: Graphics Accelerator Antivirus program
AntiGax is a free program which detects and repairs files infected by the
recent 'Graphics Accelerator' virus (also known as SevenDust-E and
MDEF-9805-E).
This archive also includes GAx Defender, which is an extension that checks
programs for the virus as you run them.
Instructions on their use are in the readme - please read it.
More information is available on the web at this address:
{P^/
John Dalgliesh
s2191331@cse.unsw.edu.au
Download autostart-worm-cleaner-lite.hqx (14,012 KB)
From: tnharris@iname.com
Subject: Autostart Worm Cleaner lite 98/05/22
Autostart Worm Cleaner lite
===========================
Release 98/05/22
Version 1.0.1
The Autostart Worm Cleaner lite is an Applescript that removes known
autostart worms. This release recognizes:
- Autostart worm 9805
- Autostart worm 9805-B
- Autostart worm 9805-C
The script requires the scripting additions Jon's Commands and
Processes (part of Script Tools). It should run on any system with
AppleScript installed.
Copyright 1998, Tom N Harris
Download bscan-2.hqx (508,420 KB)
From: mark@mrdataworks.com
Subject: BugScan 1.0b1 Revision
BugScan 1.0b1
October 23, 1998
BugScan is freeware - by downloading this file, you agree to use it at your own risk.
This application was mainly designed for our clients to determine if they do in fact have the AutoStart and Graphics Accelerator files on their hard drives. These viruses have become real pests for many of us. Make sure you use Virex or Norton Anti Virus if you get a red light (and then call your local computer consultant). If you get a green light, bonus! If you don't own one of these applications already, make one of them your next purchase.
BugScan will detect all files for all strains of the AutoStart 9805 Worm current at 10/23/98 as well the Graphics Accelerator Extension (GAX). BugScan will also detect any combination of these files. Click BugScan's 'Help' button to read more about the viruses themselves.
We strongly recommend that you restart your Mac with extensions off (holding down the 'shift' key) before running BugScan. You can now restart your Mac from directly within BugScan if needed.
BugScan gives you two scanning options:
Quick Scan Method
Checks for AutoStart and Graphics Accelerator files in their exact locations on the selected volume. This method does a top level scan and a system level scan on the selected volume (a system level scan is performed only if there is a System Folder on the selected volume).
Full Scan Method
Checks for AutoStart and Graphics Accelerator files in all locations on the selected volume - in other words, everywhere. Note that the full scan method takes much longer and even longer yet when scanning network volumes. This is, however, the recommended method.
BugScan gives you three menu options:
Install 9805 Defense
Creates invisible, locked folders in the appropriate locations on your startup disk to combat the AutoStart 9805 Worm.
Install GAX (Graphics Accelerator) Defense
Creates an invisible, locked folder in the Extensions Folder on your startup disk to combat the Graphics Accelerator Virus.
Open QuickTime Control Panel
Opens the QuickTime Control Panel and prompts you to turn the "Enable CD-ROM AutoPlay" function off. BugScan quits immediately after opening the Control Panel.
If BugScan locates any virus applications and/or virus reference files, BugScan will attempt to remove them. If any of the files are already in use (infecting your hard drive), BugScan warns you and prompts you to delete them manually. BugScan will do its very best to make any invisible files visible and to move all these files to the trash. If this is not necessary, the files will be deleted but you'll still need to do a proper virus scan to see if the rest of your Mac has been infected. Hopefully not.
Running BugScan does not make your Mac instantly 'safe'! Everyone needs to practice "safe computing" from now on!
Remember to do a proper virus scan using Virex or Norton Anti Virus. The bad news is that if you've been infected for some time now, you'll probably be looking at a complete reformat and re-install. The best advice we can give you is to get on this ASAP.
We do not provide free technical support for freeware (nor free technical support for virus-hunting, troubleshooting and maintenance).
Good luck...
Long Live Apple!
© 1995 - 1998 Mountain Ridge Dataworks
WWW: http://www.mrdataworks.com/
Written By Mark Weston
Download disinfectant-371-it.hqx (228,336 KB)
From: rotunno@wyvern.it
Subject: disinfectant 3.7.1 Italian
disinfectant 3.7.1 italian
From: Rotunno@wyvern.it
Subject: disinfectant 3.7.1 italian
Italian localized version of this famous antivirus for Macintosh.
Official translation made by: Rotunno@Wyvern.it.
See included read me files for details.
Download disinfectant-371.hqx (214,775 KB)
From: j-norstad@nwu.edu
Subject: Disinfectant 3.7.1
Disinfectant 3.7.1 is a new release of our free anti-viral utility for the
Macintosh.
3.7.1 Release Notes (July 9, 1997)
----------------------------------
Version 3.7.1 fixes an error which could sometimes cause crashes when
scanning very rare kinds of files while pass the new "more lenient"
check for damaged resource forks which was introduced in 3.7.
3.7 Release Notes (July 7, 1997)
--------------------------------
Version 3.7 detects a minor variation of the MBDF B virus which was
properly detected by the 3.6 INIT but not by the 3.6 application.
The Disinfectant manual now discusses the Microsoft macro virus problem.
The introductory text displayed in Disinfectant's main window warns that
Disinfectant does not recognize the macro viruses and refers the user to
the manual for more details.
The "All Disks" command in the "Scan" menu has been changed to "All
Local Disks". This command now only scans local disks, not network
AppleShare servers.
The "All Disks" command in the "Disinfect" menu has been changed to "All
Local Unlocked Disks". This command now only disinfects local unlocked
disks, not network AppleShare servers or locked disks like CD-ROMs or
locked floppies.
If you want to scan or disinfect servers, scan or disinfect them
individually, or use the "Some Disks" commands in the "Scan" and
"Disinfect" menus.
--
John Norstad
Download eradicator.hqx (4,523,960 KB)
From: ericsson@interlog.com
Subject: Eradicator kills new Mac worm. Freeware.
Eradicator v.1.0.1 is freeware which removes the new Mac worm Autostart
9805. It is released as a service to Mac users by Hong Kong IT company
Uptown Solutions Ltd.
Autostart 9805 infects PPC Mac OS systems (7 & 8) with QuickTime 2.0 or
above and with mounted HFS or HFS+ volumes and CD-ROM AutoPlay enabled. It
adds invisible files to every disk partition and periodically causes
extensive disk activity (and network activity if network disks are
mounted). Will overwrite some data files with random data. The worm can be
transmitted via almost any HFS or HFS+ disk volume, including floppy disks,
most removable cartridges drives, MO disks, CD-WORM disks, hard disks and
even disk images. The worm will also spread across networks to any mounted
network file partition.
Although Autostart 9805 can be removed manually using a resource editor,
Eradicator was written to ease the process. Click the Scan button to start
scanning the mounted volumes. Eradicator will report what it finds in a
window. If it finds the virus on any of the mounted volumes, it will
attempt to fix it. If the attempt is successful, a placeholder will be put
in place so that your computer is immune to future infection.
3.1 Meg Stuffit file has full documentation. Swept with Disinfectant 3.7.1
Uploader hereby disclaims any responsibility for loss of data or other
damages resulting from usage of this file.
Download gatekeeper-130.hqx (322,288 KB)
Date: Fri, 12 Nov 1993 16:38:22 -0600
From: chrisj@mbs.telesys.utexas.edu (Chris W. Johnson)
Subject: Gatekeeper 1.3 (yes, two in as many days)
--========================_36297202==_
Content-Type: text/plain; charset="us-ascii"
Gatekeeper 1.3 is a set of Macintosh system extensions (INITs)
and related control panels (cdevs) which, when active (i.e.
allowed to install themselves during the boot process) offer
protection against attacks by all known viruses (to the author
at the time of this release).
Gatekeeper also monitors computer activities for what are
considered to be suspicious 'events' or 'operations', in an
attempt to intercept what could be variants of known viruses or
even completely new viruses.
Since its initial release in January of 1989, Gatekeeper has
repeatedly demonstrated its ability to stop the spread of
viruses which were unknown during its design. Like any anti-
virus system, however, it cannot guarantee complete protection.
Of course, no claims or promises are made regarding Gatekeeper's
effectiveness or suitability, and some functions and capabil-
ities of Gatekeeper are non-trivial to use and may require a
careful reading of the documentation.
Gatekeeper 1.3 Release Notes 12-Nov-93
---------------------------------------------------
Gatekeeper 1.3 was created the day after 1.2.9 was released to fix
a bug that caused all pre-7 systems to hang during startup, and
crashed some System 7.x machines.
For those of you wondering about the story behind the bug, and
why 1.2.9 missed its scheduled release date by three days, it's
pretty simple. When the new viruses appeared, I was in the middle
of work on a new and improved Gatekeeper which was going to be
version 1.2.9 in a couple of months. Unfortunately the work, while
mostly complete, still wasn't quite finished at the time those
viruses appeared. So I had to either (a) try to finish the new
improvements very quickly, or (b) rip them all out and return,
more or less, to the functionality of 1.2.8. I went for option
'b'. Unfortunately, while I was ripping out the nifty new code, I
overlooked one file in one of the ten or so projects that currently
combine to form Gatekeeper. Consequently, some of that new code
which wasn't quite finished was built into one portion of version
1.2.9. Since it was mostly working, it passed all my in-house
(actually "in-office" would be more accurate) tests prior to
release, but failed when it finally met up with the real world.
Why didn't I just go back to the archived 1.2.8 source? Because
there were some bug fixes and various uncontroversial (but
significant) improvements already in 1.2.9 which I certainly
wanted to be part of any new release.
So, here's 1.3; use it in good health. Please delete any copies of
1.2.9 that you may have laying around and spread the word that 1.3
is available.
[Thanks, BTW, go to Brian Price for allowing himself to be
dragooned into running some last minute tests.]
----Chris
--========================_36297202==_
Content-Type: application/mac-binhex40; name="gatekeeper-13.sit"
Download good-times-virus-hoax-faq.hqx (16,746 KB)
Date: Tue, 9 May 1995 12:29:23 -0400
From: lesjones@usit.net (Leslie Jones)
Subject: Good Times Virus Hoax FAQ 5/9/95
As you probably know, the Good Times virus is a hoax. The FAQ provides
answers to many questions about the hoax, gives a history, debunks some
myths, and points to some other sources of information. The FAQ also gives
directions for finding the two-page mini FAQ.
Download hyper-gatekeeper-127.hqx (13,720 KB)
From: Wolfgang McKeown
Subject: hyper-gatekeeper-127
HyperGatekeeper is an anti-viral stack for all known HyperCard script
viruses. It is designed to detect unknown viruses as well, but whether
that will work or not depends on the individual viruses.
This stack has been tested with all the viruses I had on hand (for some
reason, HyperCard viruses are hard to find; I had to write almost all of
the test viruses myself).
I have tried to make this stack the best it can be, but then no security
is perfect. Any suggestions or complaints are welcome. (Please give a
reason for your complaint, not just "I hate this thing; I'm not using it.")
This version (1.2.7) will detect viruses that try to evade HGK by
unlocking a stack, infecting it, and then locking it again. To prevent
the annoying problem of having to answer modification dialogs on old
stacks after installing a new version of HGK, this version includes an
updater that will upgrade an installed (in the Home stack) copy of
version 1.2.5.
Wolfgang McKeown 8-)
Download innoculator-10.hqx (139,717 KB)
From: rmarasa@sprint.ca
Subject: Innoculator 1.0
Autostart 9805 worm scanner and cleaner. freeware.
Download mac-sig-95-02-02.hqx (3,687 KB)
Date: Mon, 06 Feb 95 12:25:34 pst
From: "Matt Riley"
Subject: MacSig 2/2/95.sea
Will update MacTools to find and clean the NVP trojan Horse.
Download mactools-antidotes-94-04-02.hqx (40,582 KB)
From: "Chall Fry"
Subject: Mac CPAV Antidotes 4/2/94
Date: 6 Apr 1994 14:47:25 -0800
Here's the MacTools CPAV antidotes file (aka MACSIG), dated 4/2/94.
This has the README file included, and is ready to be placed on FTP
sites. I'll also be sending this off to info-mac.
--Chall Fry--
(Central Point Software)
Download mcafee-virus-scan-101.hqx (622,821 KB)
From: (Raul Almquist) strider@shadowmac.org
Subject: McAfee VirusScan v1.0.1 for the Mac.
Complete descriptive is included in the MacFile.ID textual descriptive
file included in the archive.
Download merry-xmas-killer.hqx (7,403 KB)
From LTAYLOR@CSBINA.CSUBAK.EDU Thu Sep 2 10:50:01 1993
Date: Wed, 1 Sep 1993 22:07:07 -0700 (PDT)
From: LTAYLOR@CSBINA.CSUBAK.EDU
Subject: "Merry Xmas" Killer
I have recently experienced one of the most annoying Macintosh para-
sites of all time -- the virus.
Although only a HyperCard virus, "Merry Christmas" is an annoying
little bugger to have, like any virus. Fortunately, I was able to spot it
before it infected anything really important.
I highly suggest that anyone with HyperCard download this file. It
will scan your stacks for Merry Christmas and permanently zap it. Although
small (less than 12K) it does its job very efficiently.
Have fun with HyperCard! *Stiles
============================= cut here =============================
Download merry-xmas-vaccine-32-hc.hqx (145,957 KB)
From: BillDS@aol.com
Subject: merryxmas Vaccine 3.2
KEYWORDS: VIRUS MERRYXMAS VACCINE XMAS PICKLE ANTIBODY INOCULATE
This stack eliminates script based viruses which spread themselves by
appending the scripts of other stacks with additional instructions which
in turn infects every stack they come in contact with. The original virus
of this ilk is called "merryxmas."
Since the appearance of merryxmas, other strains have surfaced such as
merry2xmas, Lopez and others too crude to mention. merryxmas Vaccine
catches them all-and it's FREE!
NEW in v3.2
----------
A well meaning merryxmas "antibody" has appeared. Unfortunately, while it
may have good intentions, it is by definition a virus itself. It doesn't
do any harm, but it does quietly insert itself into the Home stack and
others in much the same way merryxmas does. Version 3.2 removes the
antibody.
Requirements
------------
HyperCard v2.1 or later.
Color monitors (optional) will display "status colors."
Download merry-xmas-watcher-20.hqx (59,768 KB)
Date: Tue, 28 Feb 95 10:05:21 PST
From: kdunham@eosc.osshe.edu (Ken Dunham)
Subject: merryxmasWatcher2.0.cpt.hqx
merryxmasWatcher2.0.cpt.hqx is a free HyperCard 2.1 stack that
scan and erradicates for the merryxmas and merry2xmas viruses.
The watcher script, which is installed in the Home stack of
HyperCard, will watch stacks for you as you work. By making
use of the watcher script you won't need to scan each new
HyperCard stack - you can work freely without the fear of being
infected.
You have my permission to include this in your cd-rom.
Ken Dunham, La Grande Middle School
kdunham@eosc.osshe.edu, kdunham@ednet1.osl.or.gov
Science and Math Education, Merryxmas Virus Killer, HyperCard Developer
Download rival-defs-9304b.hqx (2,599 KB)
Date: 22 Apr 93 09:22 GMT
From: NONE.FRED@AppleLink.Apple.COM (France - nOne Corp, F Miserey,IDV)
Subject: Re2: INIT-M Vaccine ready
Bill,
Will you please post the above "INIT-M Vaccine" for Rival below.
Yours,
Frederic
------------
Download rudolph-20.hqx (1,532,733 KB)
From: jinglis@flannet.middlebury.edu (Jeff Inglis)
Subject: Rudolph
Rudolph is an automated merryxmas and merry2xmas virus fighter. It can detect
and disinfect stacks infected with the merryxmas virus. Further, it inoculates
stacks against ever being infected. Rudolph is a major improvement over other
anti-merryxmas stacks in the following ways:
1) automated execution and quitting (runs unattended in "Startup Items" or
"Shutdown Items")
2) inoculation of stacks - prevent infection before it happens!
3) an option for single-file checking, disinfection, and inoculation (and not
just an entire volume)
Rudolph was created by Jeff Inglis and Jim Rodda, of the Middlebury College
Language Schools.
The merryxmas and merry2xmas viruses are HyperCard-only viruses.
Jeff Inglis
Download sam-install-scripts-12.hqx (11,971 KB)
From: gt3017c@prism.gatech.edu (William Homer Waits)
Subject: SAM Install Scripts 1.2
Date: Sun, 9 Jan 1994 00:16:40 -0500
In response to some complaints on the Internet regarding
the un-intuitive installer script for Symmantec's popular
virus program SAM* 3.5. Symmantec's script will not do an
installation if you have replaced the original Virus Definition
file. Go figure! I don't know about you, but I update mine
when necessary on the original disks. I have created my own
scripts which should work fine. I have System 7.1, and I know
it works there, but I also have created a System 6 installer.
It should work fine, but I have no place to test it. Only the
target folders have changed. These scripts only recognize the
Virus Definitions file on the Decontamination Disk, so make sure
that is where you place your updated Definition file. Also, it
you are using System 7 or greater, SAM* Intercept and SAM*
Intercept Jr. are both placed in the Extensions Folder.
If you decide to use these, please just e-mail me and let me
know that you have used it. Also, let me know about any
troubles you may have. I can be reached at the following
addresses:
gt3017c@prism.gatech.edu
or
Heathen@aol.com
My snail mail address is
William Waits
1471 Ashwood Way
Lawrenceville, GA 30243
SAM* is copyrighted by Symmantec Corp. I have no affiliation
with them.
Al Bloom, this one's for you!
Version History
-1.0 Initial Release
-1.2 Added better icons to custom window
Read Me file reflects more accurate data
Download sam3-virus-defs-95-07.hqx (31,554 KB)
Date: Tue, 01 Aug 95 09:58:50 EDT
From: "Allan M. Bloom"
Subject: SAM 3.x Virus Defs 07/28/95
NOTE: this file is for SAM 3.0.x and SAM 3.5.x only.If you have SAM
4.0.x, then you'll need to download SAMDef.405. New Virus Definitions
with a new def added for the HC9507 Hypercard virus. This is
an .sea file. Download it. Expand it. Then drop these files onto
the system folder and let them replace the files there now.
Restart to verify that it is working correctly.
Download sam4-virus-defs-95-11.hqx (32,335 KB)
From: "Allan M. Bloom"
Subject: SAM 4 Virus Defs 11/95
This is the latest version (4.07, 11/22/95) of SAM virus definitions
for version 4 of SAM. Do not use with version 3.
Sorry, no equivalent for SAM-3 was on CompuServe's Symantec forum. The
below message from Stephen Zeffren explains the update.
Al Bloom
New SAM Virus Definitions file and SAM Help file for DETECTION ONLY of
the new MSWord Macro Viruses. Download this file, expand by double
clicking on it, and then drop the two files onto your System folder to
replace the older files there now. Restart and you're set.
Download scrooge-20-hc.hqx (16,620 KB)
From: dickt@ucs.orst.edu (Thomas Dick)
Subject: Scrooge
Scrooge v2.0 kills the merryxmas hypercard virus and a good number of its
possible mutations. Also at your option inserts "antibodies" into your
stacks so that they become "immune" to this virus. The antibodies are
quite inert, but they may trigger other merryxmas virus detection
algorithms.
There were never any bug reports from the old version, but it did contain
a, er... design flaw. To depict graphically that the new version has a
better design, the icon has been changed from an elderly man to an elderly
woman.
This stack is free; It is provided as a public service. Not as fancy or
powerful as some of the other merryxmas vaccine programs, but smaller. Get
merryxmas vaccine AND Scrooge even if you don't think you're infected to
maximize herd immunity from this annoying pest. I hope the author of the
merryxmas virus comes down with terminal crab lice.
Scrooge may be freely copied and distributed as long as you don't modify it.
Send comments, bug reports re: this stack to dickt@ucs.orst.edu or
PlatySoft@aol.com
http://users.aol.com/platysoft/
Download virus-reference-216-hc.hqx (54,528 KB)
From: dpettit@Phoenix.kent.edu (Douglas Pettit)
Subject: VirusReference2.1.6
Virus Reference 2.1.6 Online Database of Macintosh Viruses
Virus Reference is a HyperCard based database of Macintosh viruses and trojan
horses. Includes search capabilities, and detailed descriptions of symptoms.
This update includes information on the Word Macro 9508 virus, recently
discovered.
Download virus-warning-20-hc.hqx (136,489 KB)
From: Matthias Kahlert
Subject: Virus Warning, Version 2.0
An AntiVirus HyperCard Stack.
This stack helps you detecting and disinfecting your stacks, which may be infected with the
"Merry XMas" Virus. You also can install an active virus protection in your home stack.
For more information use:
E-Mail: matthias.kahlert@rz.fh-regensburg.d400.de
Internet: http://rfhs0002.fh.uni-regensburg.de/~s1830/hypercard_e.html
Thanks
Matthias Kahlert, Regensburg/Germany, January 4th 1996
Download worm-guard-102.hqx (16,041 KB)
From: clarence_locke@bellsouth.net
Subject: WormGuard 1.0.2
WormGuard is a freeware system extension that actively protects you from
the AutoStart 9805 worm whenever a volume is mounted or a file is
accessed by any application. If the infection is found, it is
automatically removed and you are notified of what happened via the MacOS
Notification Manager. Version 1.0.2 fixes the AppleShare file copy bug.
Download worm-scanner-201.hqx (189,832 KB)
From: jwwalker@kagi.com
Subject: WormScanner 2.0.1 (an AutoStart worm remover)
This program scans your local drives for the AutoStart 9805 worm variants,
and will also alert you to unknown files with suspiciously similar
properties. It is based on published descriptions of the activities of
these worms. I have not
personally tested it on real worms.
Worms may lurk inside disk image files, but unless the disk image is
mounted, WormScanner will not be able to look inside.
WormScanner requires Color QuickDraw, meaning that it will not run on
machines that use the original 68000 processor.
-- James W. Walker