"ANTI Variant" Virus (17-Dec-1991)
Entry...............: "ANTI Variant" Virus
Alias(es)...........: ---
Virus Strain........: ANTI Virus Strain                                        
Virus detected when.: ---           
              where.: USA
Classification......: Link virus
Length of Virus.....: 1348 Bytes
--------------------- Preconditions ----------------------------------
Operating System(s).: MacOS proprietary             
Version/Release.....: all versions                    
Computer model(s)...: Apple Macintosh: all models
--------------------- Attributes ------------------------------------
Easy Identification.: The strings "ANTI" and "#000001" can be found 
                          in CODE 1 resource
Resource pattern....: CODE 1 is increased by 1348 bytes 
Type of infection...: Extending CODE 1 and modifying CODE 0
Infection trigger...: Running an infected application to get in 
                         memory. Use of OpenResFile.
Applications affected:All those having a CODE 0 and 1 resources with
                         size of old CODE 1 + virus <= 32768 bytes.
Traps intercepted...: OpenResFile, MountVol
Damage..............: Due to a programming error, the computer will 
                         hang if an infected application is executed.
                         If MountVol is called for a disk drive, the
                         virus searches the first sector of track 16
                         for the string $16+"%%S" at offset 8 from 
                         begin of sector (works only on 400K and 
                         800K floppies); if this string is found,
                         virus executes the code in that sector via
                         JSR call. (No such code has been discovered
                         until classification date)
Damage Trigger......: Execution of an infected application
Peculiarities.......: ---
Similarities........: ANTI A, ANTI B
--------------------- Agents -----------------------------------------
Countermeasures/direct:
Countermeasures/software:Use an anti-viral product (public domain or
                         commercial) such Disinfectant, Interferon,
                         Virus detective or VirusRx to scan for virus
                         signature.
--------------------- Acknowledgement --------------------------------
Location............: Virus Test Center, University Hamburg, Germany
Classification by...: Ronald Greinke
Documentation by....: Ronald Greinke
Date................: 17-December-1991
Information Source..: ---

.