Virus Alert
by Doug Noble
Just
a couple of years ago, computer viruses, while common on
PCs, were virtually unknown on the Macintosh. And those that
did exist on the Mac platform were generally benign, harmless.
John Nordstadt’s freeware
Disinfectant program was all most Mac people needed for virus
protection. But things have changed! There are now strains
of viruses that affect Mac users and have the potential to
destroy files on your computer. How did this happen?
One
reason is the Internet. People download files all the time,
and email attachments bring documents from others onto your
machine. But even if you are not on the ‘net, people
who are give you files on floppies, and suddenly you too
are infected!
Last year,
it was the Word macro virus that caused problems. The symptom
is that files can only be saved as document templates. It spreads
as you send infected documents to other people, once they open
the document, it runs a macro and affects their system too.
It’s not disastrous, but
once it gets into a company it takes a while to get rid of
it as every machine has to be scanned and repaired. Microsoft
has a fix on their site, search for “word macro virus
Macintosh” to find it. And it is crossplatform, it can
happen whether the creator of the document has a Mac or PC.
Hong
Kong Flu strikes the Mac!
The
latest virus to strike the Mac is a strain called the Autostart
9805 Worm Virus, which affects Power Macs. It’s also known as the
Hong Kong virus because it was first discovered there and it
spreads like the Hong Kong flu! It adds invisible application
files called “DB” to your hard disk and periodically
causes extensive disk activity.
It
can overwrite or corrupt some files with random data. It
can be transmitted via floppies, zip drives via the Internet,
across a network – in
fact any way files are moved from machine to machine. If the
Autostart feature of QuickTime is enabled, it uses this to
copy itself to the extension folder and changes the name of
the copy to Desktop Print Spooler (not to be confused with
Desktop PrintER Spooler” which is legitimate.
Once
it is running in your system, it can corrupt various types
of files. You can search for these invisible files by using
a hidden feature of Find File. Hold down the option key while
selecting “name”,
and scroll down to “visibility”. Chooose “invisible” and
then press “more choices” and add “name contains
DB”. If you find the file, drag it to the trash from
the Find File window.
Virus Protection
Just like with
flu shots, the best thing to do is keep your system protected.
One way to keep the virus off your system is to disable the
AutoPlay feature of QuickTime. Open the Control Panel called
QuickTime Settings (v2.5 or later) and uncheck the Audio and
CD-ROM AutoPlay boxes. However, once the virus is present,
this solution does not help.
Sadly,
John Nordstadt has given up trying to keep his freeware Disinfectant
up to date, and it does not detect macro viruses. But commercial
software products like Symantec’s SAM and Norton Antivirus
and Dr. Solomon’s Virex products are constantly updated
to battle the Autostart and other viruses. I strongly suggest
that you buy and install one of these products for peace of
mind and protection. It can save many hours of work repairing
your system later!
If
you have the virus, various programs such as Worm Food and
Eradicator have been posted on the net to help remove the
offending files. See the links on Ric Ford’s Macintouch site listed below for the latest
info.
http://www.drsolomon.com/products/avtk/ps_mac.html
http://www.drsolomon.com/products/virex/
http://www.symantec.com/sam/
http://www.macintouch.com/hkvirus.html
Doug Noble is co-owner of ADWEB a
South Florida web design and hosting service specializing
in Filemaker Pro database driven websites. He is also the
founder of MacTalent.
He has written technology articles for several trade publications
and is a contributor to the Gold
Coast Mac User group newsletter, Tropical Mac.
Copyright 1998 Doug
Noble doug@mactalent.com
Reproduction in any format without permission is prohibited.
|
