{ISSO}, SPECIAL SECURITY OFFICER {SSO}, INFORMATION RESOURCE MANAGER
{IRM} AND AUTOMATED DATA PROCESSOR {ADP} COORDINATORS
U-1,237/DS-SIM {DCPO}
SUBJ:  INIT 1984 MACINTOSH VIRUS {AUTOMATED SYSTEMS SECURITY
INCIDENT SUPPORT TEAM {ASSIST} 92-44}
1.  DISCUSSION:  ASSIST HAS OBTAINED INFORMATION CONCERNING THE
"INIT 1984" VIRUS THAT INFECTS APPLE MACINTOSH COMPUTER SYSTEMS. 
THIS VIRUS IS DESIGNED TO TRIGGER IF AN INFECTED SYSTEM IS BOOTED
ON ANY FRIDAY THE 13TH IN 1991 OR LATER YEARS.  DAMAGE FROM THE
VIRUS INCLUDES CHANGING THE NAMES AND ATTRIBUTES OF A LARGE NUMBER
OF FOLDERS AND FILES TO RANDOM STRINGS AND THE ACTUAL DELETION OF
A SMALL PERCENTAGE {2 PERCENT} OF FILES.  THE VIRUS ONLY INFECTS
SYSTEM EXTENSIONS OF TYPE "INIT" {ALSO KNOWN AS "STARTUP
DOCUMENTS"}.  IT DOES NOT INFECT THE SYSTEM FILE , DESKTOP FILES,
CONTROL PANEL FILES, APPLICATIONS, OR DOCUMENT FILES.  BECAUSE INIT
FILES ARE SHARED LESS FREQUENTLY THAN ARE APPLICATIONS AND 
BECAUSE OF THE STRUCTURE OF THE VIRUS CODE, THE INIT 1984 VIRUS DOES
NOT SPREAD AS RAPIDLY AS MOST OTHER VIRUSES.  THE VIRUS SPREADS AND
ATTACKS ALL TYPES OF MACINTOSH COMPUTERS UNDER BOTH SYSTEM 6 AND
SYSTEM 7.  ON OLDER MACINTOSH COMPUTERS {THOSE WITH 64K ROMS}, THE
VIRUS WILL CAUSE CRASHES AT BOOT TIME.
2.  RECOMMENDATION: CHECK AND VERIFY THE CURRENT STATUS OF YOUR
SYSTEM USING VIRUS SCANNING SOFTWARE AND TAKE THE NECESSARY ACTIONS
TO ENSURE ANY VIRUSES PRESENT ARE DETECTED AND REMOVED.  THE CURRENT
VERSIONS OF GATEKEEPER AND SAM INTERCEPT {IN ADVANCED AND CUSTOM
MODE} ARE EFFECTIVE AGAINST THIS VIRUS.  EITHER PROGRAM SHOULD
GENERATE AN ALERT IF THE VIRUS IS PRESENT AND ATTEMPTS TO SPREAD TO
OTHER FILES.  AUTHORS OF ALL MAJOR MACINTOSH ANTI-VIRUS TOOLS ARE
PLANNING UPDATES TO THEIR TOOLS TO LOCATE AND /OR ELIMINATE THIS
VIRUS.
3.  POINT OF CONTACT:  ASSIST POINT OF CONTACT FOR THIS MATTER IS
MIKE HIGGINS, COMM {202} 373-8852/55 OR DSN 243-8852/55.  ASSIST
CAN BE REACHED 24 HOURS PER DAY, COMMERCIAL PAGER {800} SKY-PAGE,
PIN NUMBER 2133937 {FROM A TOUCH TONE PHONE ENTER THE CALL BACK
NUMBER AFTER THE PROMPT} OR AUTOVON DIAL 243-8000 AND ASK TO HAVE
THE ASSIST DUTY OFFICER PAGED.  ASSIST CAN BE REACHED VIA E-MAIL 
AT "DOD-CERT{AT-SIGN}DDN-CONUS.DDN.MIL."