"MDEF B" Virus (15-July-1991)
Entry...............: "MDEF" B Virus
Alias(es)...........: "Top Cat" Virus
Virus Strain........: MDEF Virus Strain                                        
Virus detected when.: May 1990            
              where.: New York, USA
Classification......: Link virus
Length of Virus.....: 532 Bytes
--------------------- Preconditions ----------------------------------
Operating System(s).: MacOS proprietary             
Version/Release.....: System 4.1 or greater                     
Computer model(s)...: Apple Macintosh: all models
--------------------- Attributes -------------------------------------
Easy Identification.: MDEF Resource with ID 8573 in System file 
                      MDEF Resource named "Top Cat"
Resource pattern....: MDEF Resource named "Top Cat"
Type of infection...: Adding (and renaming) a MDEF resource
Infection trigger...: Executing an infected file.
Applications affected:All + Documents used by current application
Traps intercepted...: ---
Damage..............: ---
Damage Trigger......: ---
Peculiarities.......: If SAM Intercept is present it will allow 
                         changing the ID of MDEF 0 to 8573 but will 
                         prevent the adding of the MDEF "Top Cat" 
                         resource; this causes the computer to hang 
                         if a menu item is clicked.
                      The virus searchs in the memory locations 2 
                         to 200,000 for the string "MDEF"+$67+$26+$0C;
                         when found, virus changes "MDEF" to "WDEF".
Similarities........: MDEF variants
--------------------- Agents -----------------------------------------
Countermeasures/direct:1)System: Remove MDEF resource named "Top Cat"
                         and change the ID of MDEF 8573 back to 0 with
                         ResEdit.
                      2) Applications and documents: Remove MDEF 0 
                         "Top Cat" resource.
Countermeasures/software:Use a commercial anti-viral product or a 
                         public domain utility such as Virus detective, 
                         VirusRx, Interferon or Disinfectant to scan
                         for virus signatures.
--------------------- Acknowledgement --------------------------------
Location............: Virus Test Center, University Hamburg, Germany
Classification by...: Ronald Greinke
Documentation by....: Ronald Greinke
Date................: 15-July-1991
Information Source..: ---

.