2 or 3 Tunes
This is a HyperCard virus, it plays three German folk tunes when launched. The virus can cause system crashes.
AIDS
Aids infects application and system files, with no intentional damage. Aids is a nVIR B strain.
Aladin
Close relative of Frankie (see below).
ANTI
This virus changes program code, therefore causes applications to crash a lot. Can't spread under System 7.x, or System 6 under MultiFinder.
Strains: Anti-A, Anti-Ange, Anti-B, Anti-Variant.
Antibody
Is a HyperCard virus and causes no damage. It checks for the MerryXmas virus, and then deletes it from all stacks.
AppleScript Trojans
AppleScript trojan viruses can be extremely destructive, they are to be treated like a program, if you run such a program which is alien to you, you may invoke a hard disk initialisation or it may go through all of your files and scramble it's Type and Creator codes. This type of virus is very easy to create and even easier to be undetected.
AppleScripts should be downloaded only from known trusted sources. It is nigh impossible for an average person to know what any given compiled script will do.
AutoStart 9805
The AutoStart virus is a 'worm', and it spreads via any HFS disk. Worms are self contained programs that replicate themselves at will. Some are destructive, over writing certain files with random data.
Symptoms: Perhaps the most noticeable symptom of the worms is that an infected system will lock up and have unexplained delays and disk activity every 6, 10, or 30 minutes. Certain file types will have been damaged or deleted:
* Autostart 9805 will overwrite files ending with .data, .cod or .csa that are over 100 bytes.
* Autostart 9805-E will write over some image files with random data, these are; JPEG, TIFF and EPSF picture files, only if they are bigger than 10,424 bytes.
* Autostart 9805-F will delete files ending with .data, .cod, .csd that are over 100 bytes, and .dat files that are over 2,063,232 bytes (total of the data & resource forks). It only infects PPC Macs, it is incompatible with 68K Macs.
Strains: Autostart 9805-B, Autostart 9805-C & D (are really Autostart worm killers), Autostart 9805-E, Autostart 9805-F.
Autostart (invisible) Extensions/apps to look out for: DB or BD, and Desktop Print Spooler or Desktop Printr Spooler.
Blink
Is a non-destructive Hypercard virus, which spreads to other Hypercard stacks, starts on January'99.
CDEF
This virus infects the desktop file and any mounted floppy disks. It causes system crashes and strange behaviour. System 7 can eradicate the virus simply by rebuilding the Desktop file, it is NOT necessarily immune to this virus.
ChinaTalk Trojan
ChinaTalk Trojan disguises itself as a female MacinTalk sound driver. This is a very destructive virus, it deletes the directories of all mounted hard drives and floppy disks.
CLAP
A 'nVIR' variant that fools Disinfectant to avoid detection (Disinfectant 3.6-3.7 recognises it).
CODE 1
Infects applications and system files. If the hard disk's name changes to "Trent Saburo" then you are infected and causes system crashes and some damage.
CODE 252
Infects the system file and then all applications. If you are infected, it displays a message, "You are infected with a virus. Ha Ha Ha. Now Erasing all disks. Ha Ha Ha (Click to continue)". The virus does NOT erase disks. It can crash System 7 and damage files, but doesn't spread beyond the System file.
Alias: D-Day Virus.
CODE 32767
Once a month, it tries to delete documents. These are the times it will activate itself, for an hour each time; Jan 6th 9am, Feb 9th 10am, Mar 12th 11am, Apr 5th 12pm, May 16th 1pm, June 18th 2pm, July 5th 3pm, Aug 4th 4pm, Sept 1st 5pm, Oct 20th 6pm, Nov 15th 7pm, Dec 18th 8pm. This is a destructive virus.
Code 9811
Hides applications, replacing them with garbage files named ie. 'FIDVCXWGJKJWLOI'. It also produces a desktop covered with electronic worms, and also displays the message "You have been hacked by the Pretorians."
CPro Trojan
CPro disguises itself as an update to Compact Pro (a compression program). This is a very destructive virus, it formats all hard disks and floppy disks.
Dukakis
This is a HyperCard virus. It quickly spreads to other Hypercard docs, then displays the message "Dukakis for President" and deletes itself.
Excel Macro Viruses
Strains: Laroux (quite harmless), Xtras.A.
Flag
Unrelated to WDEF A and B, but was given the name WDEF-C in some anti-virus software. Not intentionally damaging but when spreading it overwrites any existing WDEF resource of ID:0, an action which might damage some files.
FontFinder
Supposed to lists fonts used in a document, but actually deletes folders.
Frankie
This virus infects Macintosh emulators. When activated, it draws a bomb and then displays: "Frankie says: No more piracy!", then causes a crash.
Alias: Aldus.
Fuck
Infects application and System files. No intentional damage (nVIR B strain).
HC 9507
This infects HyperCard docs only. Once infected, the virus spreads to other randomly chosen Hypercard docs. It causes the screen to fade in and out, and the word pickle is typed automatically, or a system freeze/shutdown.
HC 9603
Infects HyperCard docs. The virus does not cause any damage.
Independance Day
It attempts to be destructive, but fortunately it is not well enough written to be more than a nuisance.
INIT 17
Displays message "From the depths of Cyberspace" the first time it triggers. INIT17 infects the System file immediately and then all applications. It can cause file damage and system crashes due to accidental damage, especially on 68K Macs.
INIT 1984
Infects system Extensions (INITs). It is activated on Friday 13th. It is a very destructive virus. It damages files by changing filenames and it's file Type & Creator to random characters, on any System 6/7 Mac.
INIT 29
INIT 29 infects System files. It infects data files as well as programs, infected data files do not spread the virus. This devious virus also tells you to unlock locked disks by saying it needs minor repairs, then promptly infects it. The virus does not do intentional damage, though it can cause printing problems, system crashes.
Strains: INIT 29A, INIT 29B.
INIT 9403
Infects the Finder and other applications/files, and then attempts to ERASE the system disk and other mounted hard disks. It is a very destructive virus.
Alias: SysX.
INIT 9403 Trojan
This trojan horse, disguises itself as an application called RamDoubler. It also appears in some other applications.
INIT M
The INIT-M virus, is a very destructive virus that spreads applications, system Extensions, documents and preference files. It rename files and folders with random text, changes the creation/modification dates, and scrambles the file creator/type information, it is triggered on Friday the 13th. A dead give away is a preference called FSV Prefs. This virus infects System 7 or above.
Alias: MindCrime.
Laroux
This is an Excel macro virus. It creates a hidden, blank worksheet in infected documents, but it is not destructive.
MacMag
Is a HyperCard stack, it disguises itself as a program called New Apple Products and infects the System file, on Hard Disks and floppies. Set to trigger and self-destruct on March 2nd, 1988, so it is rarely found.
Strains: Aldus, Brandow, Drew, Peace.
Macro Viruses
Many of these only infect the application's files - however, some can do other damage. Be extra vigilant with Microsoft products, ie. MS Word and MS Excel - although they can infect any application that uses macros. Also note that it is unlikely that a macro can activated on a different word processor, as the macro language will mostly be different, therefore rendering the macro virus useless. However I'm not sure whether docs created on one platform and transferred to the Mac (PC to Mac for instance), using the same creator program, will infect your Mac?!
Macro viruses: ABC, Alex, Alien, Alliance, Ammy, Anak, Andry, Angel, Angus, Ant, AntiConcept, Appder, Archer, Armadillo, Atom, Attack, Auge, Baby, BadBoy, Balrog, Balu, Bandung, Bertik, Birthday, Bismark, Black, Blachyrkh, Blee, Boom, Box, Breeder, Buero, Calender, Cap, Cebu, CeeFour, Chaka, Chaos, Cartman, Cheat, Clock, CMD, Colors, Concept, Counter, CountTen, Crema, Cult, CVCK1, Czech, Dance, Daniel, Dark, Date, Dave, Defender, Delta, Demon, Dietzel, Disco, Dishonor, Divina, DMV, Doggie, Dracula, Drugs, DWMVCK1, DZT, Easy, Envader, Epidemic, Eraser, Fake, Fire, Five, FormatC, FormatS, Four, Frenzy, Friday, Friendly, Fury, FutureNot, Fuzzy, Gable, Gambler, Gangsterz, Gas, Gest, Gnomo, Goggles, GoldFish, GoldSecret, Goodnight, Gsis, Habir, Haggis, Hark, Hassle, Header, Hellgate, Helper, Hiac, Hider, Hitman, Hot, Hunter, Hybrid, Hyper, Illiterate, Imposter, Incarnate, India, Inexist, Influenza, InsideOut, Irish, Italian, Ivana, jaja, Jerm, Johnny, JunkFace, Kerrang , KillDLL, KillDos, KillLuf, Killok, KillProt, Komcon, Kompu, Lazy, Lemon, Look, Lord, Louvado, Lox, Lucy, Lunar, Lunch, Macaroni, MadDog, Magnum, Malaria, Malice, Mark, MDMA, Mental, Mercy, Mess, Messenger, MG, Mind, Minimal, Mota, MTF, Muck, Munch, MVDK1, MVDK2, NF, NiceDay, Nightshade, Niki, Nikita, Niknat, NJ-WMDLK1, NJ-WMDLK1A, NJ-WMDLK1B, NJ-WMDLK1C, NJ-WMDLK1D, NJ-WMDLK1E, NJ-WMVCK1, NJ-WMVCK2, No-F, Nomvir, NOP, NoPrint, Nottice, No_va, NPad, Nuclear, Nuker, Oblom, Ochy, OldPad, Olympic, OPIM, Ordo, Orhey, Outlaw, Oval, Panjang, Paper, PayCheck, Percent, Pesan, Phantom, Phardera, Pig, Plushad, Polite, PWD, Quick, Random, Rapi, Rats, RatsAss, Razer, Red, Reflex, Rehenes, Rellik, Safwan, Sam, Satanic, Saver, Schoo, Sshumann, Screw, Setmd, Shadow, ShareFun, ShowOff, Shuffle, Silly, Simple, Since, Slow, Smiley, Snickers, Socks, Sparkle, Spiral, Splash, Spooky, Spy, Strezz, Stryx, Sunbeam, Surabaya, Switcher, Switches, Swlabs, Swlabs1, Swlabs2, Sword, Talon, Tamago, Target, Tear, Tedious, Tele, Temple, Terror, TestDoc, Theatre, Toten, Trap, Trash, Twister, Twno, TwoLines, Uka, Underground, Unhas, Vampire, Varmint, VHDL, Vicinity, Viva, Vivat, Wallpaper, Want, Wazza, Weather, Why, WiederOeffnen, WMVH1, Wazzu, Wompat, Wompie, Xenixos, Yaka, Zero, ZMB, Zoolog.
MBDF
This one infects the system, finder and any applications. It does not damage, but it may cause regular system and program crashes. It spreads under System 6 and 7. These 3 games; Tetracycle, 10 Tile Puzzle and Obnoxious Tetris contain this Trojan virus.
Strains: MBDF A, MBDF B.
MDEF
These viruses are not malicious in intent, but can cause system crashes and other unexplained behaviour. An infected program may have garbled pull-down menus.
Strains: MDEF A, MDEF B, MDEF C, MDEF D.
Aliases: Garfield (MDEF A), Top Cat (MDEF B).
MDEF-E & MDEF-F
Are simple and benign viruses. They infect applications and system files, and do not cause intentional file damage.
Merry XMas
The Merry Xmas virus infects HyperCard docs and has several strains. This virus can cause irreparable damage to Hypercard docs by adding or deleting scripts. Delete infected docs instead of repairing them, where ever possible.
Mosaic Trojan
Is a program that is supposed to display graphics, but actually mangles directory structures. This is a very destructive virus.
nVIR Family
This virus infects the System file and applications. If MacinTalk is installed in your System Folder, your computer will occasionally say "Don't Panic" or it may beep unexpectedly. It can also cause programs and the System to crash. Some strains are destructive.
Strains: AIDS, Fuck, Hpat, J-nVIR, Jude, MEV#, MODM, nCAM, nFlu, nVIR A/B/C, prod, zero.
NVP & NVP Trojan
When launched, the NVP virus stops these letters 'a e i o u' from being typed. NVP does not attempt to spread to other files.
Peace
The Peace Virus, is introduced by a HyperCard doc called New Apple Products. This virus infects and spreads to system files only. It displays a peace message on March 2, 1988. The virus then self-destructs, no damage is done.
Scores
This virus spreads rapidly to all applications every time the Mac is restarted. There is one tell tale sign that Scores is on your Mac, it changes the Note Pad and Scrapbook files, to dog-eared icons. Scores causes system crashes and other abnormal problems, especially when printing.
Strains: Eric, San Jose Flu, NASA, VULT.
SevenDust
A family of four viruses which spread both through MDEF resources and a system Extension created by those resources. Three of these viruses cause no other damage. On the sixth day of the month, one may erase all non-application files on the current volume.
Strains: SevenDust A, SevenDust B, SevenDust C, SevenDust D, SevenDust E, SevenDust F.
Aliases: 666, MDEF 9806 A, MDEF 9806 B, MDEF 9806 C, MDEF 9806 D.
Steroid Trojan
Control Panel - claims to improve QuickDraw speed, but actually destroys the directory structure of your hard disk. This is a very destructive virus.
T4
Was in a game called GoMoku (v2/2.1), on the internet. It is a destructive virus, it causes significant damage to the system file, Extensions and applications. Resulting in an unbootable Mac, and unusable programs.
Strains: T4 A, T4 B, T4 C.
T4-D
It deletes files other than the System file from the System Folder, and documents. This is a very destructive virus.
Tetricycle Trojan
This virus hides in a game called Tetricycle. When it is launched, it infects the System, Finder and any applications. It causes System file and program damage.
Virus Info
This trojan virus disguises itself as a program which claims to provide virus info, but when launched, will destroys the directory of your hard drive. This is a very destructive virus.
WDEF
The WDEF virus spreads in System 6 via the Desktop file. It does not damage data files, but it can cause frequent System crashes. System 7 Desktop files are relatively immune to WDEF, only if you rebuild the desktop regularly.
Strains: WDEF A, WDEF B.
ZUC
ZUC and it's strains, infects applications and displays the annoying symptom of controlling the movement of the cursor on your screen. Once the infection reaches the Finder file, the computer becomes virtually unusable.
Strains: ZUC A, ZUC B, ZUC C.