"ANTI B" Virus (17-Dec-1991)
Entry...............: "ANTI B" Virus
Alias(es)...........: ---
Virus Strain........: ANTI Virus Strain                                        
Virus detected when.: ---           
              where.: USA
Classification......: Link virus
Length of Virus.....: 1144 Bytes 
--------------------- Preconditions ----------------------------------
Operating System(s).: MacOS proprietary             
Version/Release.....: all versions                    
Computer model(s)...: Apple Macintosh: all models
--------------------- Attributes ------------------------------------
Easy Identification.: The strings "ANTI" and "#000001" can be found in 
                         the CODE 1 resource
Resource pattern....: CODE 1 is increased by 1144 bytes
Type of infection...: Extending CODE 1 and modifying CODE 0
Infection trigger...: Running an infected application to get in 
                         memory. Use of OpenResFile.
Applications affected:All those having a CODE 0 and 1 resource with
                          size of old CODE 1 + virus <= 32768 bytes.
Traps intercepted...: OpenResFile, MountVol
Damage..............: If MountVol is called for a disk drive, this
                         virus searches the first sector of track 16
                         for the string $16+"%%S" at offset 8 from 
                         begin of sector (works only on 400K and 
                         800K floppies); if this string is found,
                         virus executes the code in that sector via 
                         JSR call. (No such code has been discovered
                         until classification date)
Damage Trigger......: Invocation of MountVol
Peculiarities.......: ---
Similarities........: ANTI A, ANTI Variant
--------------------- Agents -----------------------------------------
Countermeasures/direct:
Countermeasures/software:Use an anti-viral product (public domain or
                         commercial) such Disinfectant, Interferon,
                         Virus detective or VirusRx to scan for virus
                         signature.
--------------------- Acknowledgement --------------------------------
Location............: Virus Test Center, University Hamburg, Germany 
Classification by...: Ronald Greinke
Documentation by....: Ronald Greinke
Date................: 17-December-1991
Information Source..: ---

.