New Macintosh Virus Discovered (INIT-29-B) 2 April 1994 Virus: INIT-29-B Damage: Alters applications, system files, and documents. May cause unexpected program failures or system crashes. Spread: few reported cases yet, but might have spread widely. Systems affected: All Apple Macintosh computers, all systems. The INIT-29 virus first appeared in late 1988. We do not know much about its origin. A variant of the INIT-29 virus has recently been discovered at a West Coast US site. Its behavior is similar to that of the original INIT-29 virus. Both strains of INIT-29 spread quickly and widely. INIT-29 viruses will alter and infect almost every kind of file, including document (data) files; infected document files do not spread the INIT-29 virus, however. All versions of INIT-29 will infect both applications and systems files, and will spread from those files. An application on an infected computer may itself become infected even if it is not launched or executed. INIT-29 viruses may reveal themselves when a locked floppy disk is inserted in the disk drive. An infected Mac will display the alert: The disk "xxxxx" needs minor repairs. Do you want to repair it? Previous experience with the original INIT-29 virus indicates that the INIT-29-B version may cause printing problems and unexpected crashes. Some applications may fail to run correctly. Damage may occur as a result of the file and application modifications. According to feedback from the publishers and authors of the major anti-viral software programs, information about possibly needed upgrades to known, actively supported Mac anti-virus products is as follows: Tool: Central Point Anti-Virus Status: Commercial software Revision to be released: 3.0d Where to find: Compuserve, America Online, sumex-aim.stanford.edu, Central Point BBS, (503) 690-6650 When available: now Comments: New 'MacSig' antidote file available - dated 4/2/94. Tool: Disinfectant Status: Free software (courtesy of Northwestern University and John Norstad) Revision to be released: 3.5 When available: now Where to find: usual archive sites and bulletin boards -- ftp.acns.nwu.edu, sumex-aim.stanford.edu, rascal.ics.utexas.edu, AppleLink, America Online, CompuServe, Genie, Calvacom, MacNet, Delphi, comp.binaries.mac Tool: Gatekeeper Status: Free software (courtesy of Chris Johnson) Revision to be released: 1.3.1 When available: last released version (1.3) is effective; no update needed Where to find: usual archive sites and bulletin boards -- microlib.cc.utexas.edu, sumex-aim.stanford.edu, rascal.ics.utexas.edu, comp.binaries.mac Comments: revision 1.3.1 (responding to INIT-9403) remains pending; release date is currently not available. It is recommended that you use the latest version of Disinfectant INIT together with the latest released version of GateKeeper; this will provide satisfactory protection. Tool: Rival Status: Commercial software Revision to be released: N/A When available: now. Where to find it: America Online: RIVAL, AppleLink: TESTNONE, Compuserve: 73112,2144, Internet: miserey@laguna.ics.uci.edu Comments: The current version of Rival detects and removes INIT-29-B Tool: SAM (Virus Clinic and Intercept) Status: Commercial software Revision to be released: 3.5.12 When available: now Where to find: CompuServe, America Online, Applelink, Symantec's Customer Service @ 800-441-7234 Comments: Updates to various versions of SAM to detect and remove INIT-29-B are available from the above sources. Tool: Virex Status: Commercial software Revision to be released: 5.03 Where to find: Datawatch Corporation (919) 549-0711 When available: now Comments: Virex 5.03 will detect the INIT29-B in any file, and repair any file that has not been permanently damaged. All Virex Protection Service members will automatically be sent an update on diskette. All other registered users will receive a notice by mail. Datawatch's BBS number is: (919) 549-0042. UDV Code for INIT29-B Guide Number = 15753664 1: 0302 3000 1276 0000 / 57 2: A9F0 303C A997 A146 / 9D 3: 2028 FFFC 8180 9090 / 4C Tool: VirusDetective Status: Shareware Revision to be released: N/A When available: now Where to find: various Mac archives Comments: VirusDetective is shareware. The current version (5.0.11) identifies INIT-29-B. If you discover what you believe to be a virus on your Macintosh system, please report it to the vendor/author of your anti-virus software package for analysis. Such reports make early, informed warnings like this one possible for the rest of the Mac community. If you are otherwise unsure of who to contact, you may send e-mail to spaf@cs.purdue.edu as an initial point of contact. Also, be aware that writing and releasing computer viruses is more than a rude and damaging act of vandalism -- it is also a violation of many state and Federal laws in the US, and illegal in several other countries. If you have information concerning the author of this or any other computer virus, please contact any of the anti-virus providers listed above. Several Mac virus authors have been apprehended thanks to the efforts of the Mac user community, and some have received criminal convictions for their actions. This is yet one more way to help protect your computers.