MBDF A Virus (25-July-1992)
Entry...............: MBDF A Virus
Alias(es)...........: ---
Virus Strain........: ---                                          
Virus detected when.: February 1992           
              where.: Wales
Classification......: Link virus, System & applications
Length of Virus.....: Resource fork extension 638 bytes
--------------------- Preconditions ----------------------------------
Operating System(s).: MacOS proprietary             
Version/Release.....: System 4 or greater including system 7                   
Computer model(s)...: Apple Macintosh: See ROMs under Traps affected.
                         All other systems if ChangedResource is 
                         called via ROM.
--------------------- Attributes ------------------------------------
Easy Identification.: MBDF resources with ID 0 and 1 in System file;
                      MBDF 0 with size 630 bytes
Resource pattern....: MBDF ID 0 630 Bytes
Type of infection...: System: Renumbering any existing MBDF 0 to
                              MBDF 1; adding MBDF ID 0 to file.
                      Applications: Adding MBDF ID 0 if file has none.
Infection trigger...: Executing an infected file to infect System.
                      Running an application under an infected system.
Applications affected:All files that use menus and have no MBDF 0
Traps intercepted...: For the following ROMs: 
                          Mac II,x,cx,ci,SE,SE/30,Portable ROMs,
                      the following traps are called via direct ROM 
                      calls: AddResource
                             SetResAttrs
                             ChangedResource
                             WriteResource
Damage..............: Permanent damage: none
                      Transient damage: none
Damage Trigger......: ---
Peculiarities.......: Applications may have MBDF resources (compare 
                         size) 
Similarities........: ---
--------------------- Agents -----------------------------------------
Countermeasures/direct: Boot from clean system disk, remove MBDF 0 
                         from System file; change MBDF 1 to MBDF 0 
                         with ResEdit; remove all MBDF 0 resources 
                         with size 610 bytes from applications. 
Countermeasures/software: Use of a commercial anti-viral product or a 
                         public domain utility such as Virus detective, 
                         VirusRx, Interferon or Disinfectant >= 2.6
                         to carry out virus signature scans.
--------------------- Acknowledgement --------------------------------
Location............: VTC University Hamburg,Germany
Classification by...: Ronald Greinke
Documentation by....: Ronald Greinke
Date................: 04-April-1992

.