Xref: utzoo comp.sys.mac:23765 comp.sys.mac.programmer:3459
Path: utzoo!utgpu!watmath!clyde!att!osu-cis!tut.cis.ohio-state.edu!mailrus!cornell!uw-beaver!fluke!ssc-vax!bcsaic!lbaum
From: lbaum@bcsaic.UUCP (Larry Baum)
Newsgroups: comp.sys.mac,comp.sys.mac.programmer
Subject: Re: nVIR virus found in "Kill Virus"
Message-ID: <9062@bcsaic.UUCP>
Date: 7 Dec 88 16:49:07 GMT
References:  <579@uva.UUCP> <226@taniwha.UUCP>
Reply-To: lbaum@bcsaic.UUCP (Larry Baum)
Organization: Boeing Computer Services AI Center, Seattle
Lines: 23

In article <226@taniwha.UUCP. michael@taniwha.UUCP (Michael Hamel) writes:
.
.AntiPan exterminates nVIR from the system files and all applications
.on whatever volume you point it at. It also requires you to
.reboot if nVIR is resident in the system heap. Someone (I'm afraid I
.don't recall who) posted a remark recently saying that AntiPan sometimes
.failed. I tried to mail him, but I assume my mail got lost as I have had no
.reply. I would be most interested in any known cases of failure, as I know
.of none and will fix any bugs when I get back to the sources in New Zealand
.next week...


As it happened we discovered nVIR on our system just as AntiPan arrived.  It was
extemely effective but it did fail on a couple of files.  All but one of these
were Lightspeed C applications and Lightspeed C itself.  We used Virus Detective
on those and that seems to have fixed the problem.  Someone has told me that LSC
has nVIR immunity built in (with dummy nVIR resources maybe?), so that might be
the reason.  The only other interesting thing that happened is that even though
AntiPan reported no problem with DA Handler (i.e. it either claimed to have
diinfected it or found it clean), Virus Detective still found nVIR when we ran it
subsequent to using AntiPan.

LSB