"MDEF C" Virus (10-Aug-1991)
Entry...............: "MDEF C" Virus
Alias(es)...........: ---
Virus Strain........: MDEF Virus Strain                                        
Virus detected when.: May 1990            
              where.: New York, USA
Classification......: Link virus
Length of Virus.....:  Bytes
--------------------- Preconditions ----------------------------------
Operating System(s).: MacOS proprietary             
Version/Release.....: All                     
Computer model(s)...: Apple Macintosh: all models
--------------------- Attributes ------------------------------------
Easy Identification.: (MDEF Resource with ID 6982 in System file) 
                         MDEF 0 Resource
Resource pattern....: MDEF Resource ID 0 (and old MDEF 0 with ID 6982)
Type of infection...: Adding (and renaming) an MDEF resource
Infection trigger...: Executing an infected file.
Applications affected:All + Documents used by current application 
Traps intercepted...: (only 128 and 256K ROMs)
                         AddResource, ChangedResource 
Damage..............: Due to an error in this virus, an invocation of
                         AddResource may crash the system because 
                         AddResource will point to ChangedResource 
                         which has a different number of arguments; 
                         garbage left on stack may cause problems. 
Damage Trigger......: Infecting one file
Peculiarities.......: If SAM Intercept is present, it will allow 
                         changing the ID of MDEF 0 to 6982 but will
                         prevent the addition of the MDEF 0 resource.
                         This causes the system to hang if a menu 
                         item is activated.
Similarities........: MDEF A,B viruses
--------------------- Agents -----------------------------------------
Countermeasures/direct:1.System: Removal of MDEF resource ID 0 and
                                 changing the ID of MDEF 6982 back 
                                 to 0 with ResEdit.
                       2. Applications and documents: Remove MDEF 0 
                                 resource.
Countermeasures/software:Use an anti-viral product (public domain or
                         commercial) such Disinfectant, Interferon,
                         Virus detective or VirusRx to scan for virus
                         signature.
--------------------- Acknowledgement --------------------------------
Location............: Virus Test Center, University Hamburg, Germany
Classification by...: Ronald Greinke
Documentation by....: Ronald Greinke
Date................: 10-August-1991
Information Source..: ---

.