"WDEF" Virus (15-July-1991)
Entry...............: "WDEF" A Virus
Alias(es)...........: ---
Virus Strain........: WDEF Virus Strain                                        
Virus detected when.: March 1991             
              where.: Hannover,Germany
Classification......: File infector: Desktop only
Length of Virus.....: Resource fork extension: 1836 bytes
--------------------- Preconditions ----------------------------------
Operating System(s).: MacOS proprietary             
Version/Release.....: System 4.1 or greater                     
Computer model(s)...: Apple Macintosh: all models with ROM < 512K 
--------------------- Attributes ------------------------------------
Easy Identification.: Additional WDEF 0 resource in Desktop file;
                         Desktop shouldn't have one.
Resource pattern....: Desktop File: WDEF 0  1836 Bytes
Type of infection...: Virus copies itself to all Desktop files on all
                         connected volumes.
Infection trigger...: Executing an infected Desktop file and a random
                         algorithm produces the value 1 long and the
                         availability of SysEnvirons-Trap; the random 
                         value is calculated using the RandomSeed
                         system variable.
Applications affected:Desktop files only 
Traps intercepted...: Only during infection: Write,AddResource, 
                         ChangedResource,WriteResource,UpdateResFile
Damage..............: Permanent damage: ---
                      Transient damage: Only when running under Multi 
                         Finder. Only first launched application: if
                         the application has a menu that displays
                         font-size-information using the system, 
                         available font sizes are no longer displayed
                         outlined; all sizes are displayed in normal 
                         style. Switching between applications doesn't
                         change the first application's behavior.
Damage Trigger......: Running an infected Desktop file.
Peculiarities.......: No infection on systems without SysEnvirons
Similarities........: CDEF 
--------------------- Agents -----------------------------------------
Countermeasures/direct:
                      1. Removal of WDEF 0 from all Desktop files:
                         Copy Desktop to another file and cut off 
                         WDEF 0 resource, delete original Desktop 
                         file and rename cleaned copy to Desktop.
                         The desktop file is always active, so 
                         copying and renaming must be done with
                         special file utilities such as the file 
                         tools DA.
                      2. Create a new Desktop file by pressing Option
                         and Command keys when opening a volume.
                         This can be very time consuming on a full
                         harddisk, and information in the comment
                         field of file information is lost.  
Countermeasures/software:
                      1. Use of a commercial anti-viral product or a 
                         public domain utility such as Virus Detective, 
                         VirusRx, Interferon or Disinfectant (can't 
                         remove it) to scan for virus signature.
                      2. Use a protection INIT called Eradicat'Em 
                         that prevents WDEF (and CDEF) infection.
--------------------- Acknowledgement --------------------------------
Location............: Virus Test Center, University Hamburg, Germany
Classification by...: Ronald Greinke
Documentation by....: Ronald Greinke
Date................: 15-July-1991
Information Source..: ---

.