INIT 1984 Virus (25-July-1992)
Entry...............: INIT 1984 Virus
Alias(es)...........: ---
Virus Strain........: ---                                            
Virus detected when.: March 1992           
              where.: Ireland
Classification......: Link virus, files of type INIT;stealth (attempt)
Length of Virus.....: INIT ID 1984 bytes
--------------------- Preconditions ----------------------------------
Operating System(s).: MacOS proprietary             
Version/Release.....: System 4.1 or greater                     
Computer model(s)...: Apple Macintosh: all models
--------------------- Attributes ------------------------------------
Easy Identification.: INIT ID 1984; STR ID 1984 "SCULLEY MUST DIE!"
Resource pattern....: INIT ID 1984 4342 bytes
Type of infection...: Adding INIT ID 1984 and STR ID 1984 resource
Infection trigger...: Executing an infected INIT. The virus has a 
                         counter in STR ID 1984; depending on its 
                         value, the virus tries to infect another 
                         INIT within 6 seconds, and subsequently
                         tries to deactivate SAM Intercept.
Applications affected:All files of type "INIT"
Traps intercepted...: None
Damage..............: Transient damage: ---
                      Permanent damage: several actions: 
                         Renaming all files to random 8 byte names;
                         files to be renamed will be choosen in
                         alphabetical order, so some files will be 
                         renamed more than once while some won't be 
                         renamed at all.
                         Changing Type and Creator to random 4 byte 
                            values;
                         Changing creation and modification date to 
                            January 1st, 1904. 
                         Files that can't be renamed (when filename 
                            exists or new name contains ":")  will 
                            be deleted.  
Damage Trigger......: Running an infected system on any Friday-13th.
Peculiarities.......: The virus tries to deactivate SAM Intercept 
                         but it searches for the wrong file type.
Similarities........: ---
--------------------- Agents -----------------------------------------
Countermeasures/direct: Remove all INIT 1984 resources from all INIT's
                        Remove all STR 1984 resources from all INIT's 
Countermeasures/software:Use of a commercial anti-viral product or a 
                         public domain utility such as Virus detective
                         or Disinfectant >=2.8 to carry out virus 
                         signature scans.
--------------------- Acknowledgement --------------------------------
Location............: Virus Test Center, University Hamburg, Germany
Classification by...: Thomas Piehl
Documentation by....: Ronald Greinke
Date................: 13-July-1992

.