Xref: utzoo comp.sys.mac:23388 comp.sys.mac.programmer:3306 Path: utzoo!utgpu!watmath!clyde!att!rutgers!uwvax!puff!cat18!drew From: drew@cat18.CS.WISC.EDU (Shawn Drew) Newsgroups: comp.sys.mac,comp.sys.mac.programmer Subject: nVIR is back! Keywords: nVIR, virus, death, destruction Message-ID: <2051@puff.cs.wisc.edu> Date: 29 Nov 88 17:17:55 GMT Sender: news@puff.cs.wisc.edu Reply-To: drew@cat18.CS.WISC.EDU (Shawn Drew) Organization: U of Wisconsin CS Dept Lines: 21 nVIR is back, and it's meaner than ever! I think I've discovered a new strain/mutation of nVIR. This one seems to change the name of some programs infected with old nVIR to "nVIR" while changing the icon to the generic application icon. Also, the old nVIR used CODE ID#32 in applications, the new nVIR uses CODE ID#256. It is not stopped by KillVirus! KillVirus doesn't even notice it! This may be do to the new CODE ID#. The only way to stop it that I know of is to get in there with ResEdit and yank it out! Install a nVIR resource of ID#10, (name it "nVIR Inhibitor" for your own peace of mind) and replace the code of CODE ID#256 with $4E75. You have been warned! Disclaimer: The opinions expressed in this article do not represent those of my employer. They're for sale, if you want them. drew@cat18.cs.wisc.edu Does the name Pavlov ring a bell?