Guest User!

You are not Sophos Staff.

Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 4 replies
  • Subscribers 6 subscribers
  • Views 2076 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

found some viri in ancient apps

ed_andrews

in this this post

http://http://openforum.sophos.com/t5/Sophos-Anti-Virus-for-Mac-Home/does-sophos-actually-detect-any-mac-viri-or-threats/td-p/497

i asked if sophos detects old mac viruses

well it appears to find some

i found nvir in a couple of old apps on my boot drive

unfortunately the only repair option offered is discard and get new, not so easy with ancient apps

fortunately after a heck of a lot of googling i found replacements

nevertheless i also set about repairing the files manually

i inspected the the resource forks with rezilla

one file had a code 256 resource of 422 bytes a leftover from an incomplete repair with virusbarrier

the other had the full virus, although an inspection of the code 0 and nvir 2 resources showed it had naver been activated

i removed the bad guys and saved the files

i then ran sophos on the replacement files and inspected them with rezilla as well

they were virus free

then i compared the repaired files with the replacemeents

they were identical

it would be nice if sophos offered a file repair function or at least a library of how to nfo for self repair

getting replacements for ancient files is getting harder every day

btw

i also scanned the infected files with clamav [latest] and virusbarrier 5 [outdated]

both files came up clean

clamav has never flagged a classic mac virus

vb5 does, but apparently only when it considers the villain complete or active

thanx

:1000763


This thread was automatically locked due to age.
Parents
  • 0

    Personally, I think your best bet for automatic cleanup of old files is to make them available to a classic OS running in an emulator, such as Basilisk II or Mini vMac, with Disinfectant and GateKeeper installed.  Disinfectant should have no problems with the cleanup, once you know the virus is there.

    This would be a pretty esoteric thing to add to a KB article; I wouldn't want to step most users through safely using rezilla or setting up a safe emulation environment for cleaning.

    By the way, Disinfectant also contains analysis of all the old viruses, which for most of them makes them trivial to clean up after detection.  I wouldn't want to attempt any cleanup while not in a classic environment however, as you never know what damage you might do to your resource forks.

    :1000769
Reply
  • 0

    Personally, I think your best bet for automatic cleanup of old files is to make them available to a classic OS running in an emulator, such as Basilisk II or Mini vMac, with Disinfectant and GateKeeper installed.  Disinfectant should have no problems with the cleanup, once you know the virus is there.

    This would be a pretty esoteric thing to add to a KB article; I wouldn't want to step most users through safely using rezilla or setting up a safe emulation environment for cleaning.

    By the way, Disinfectant also contains analysis of all the old viruses, which for most of them makes them trivial to clean up after detection.  I wouldn't want to attempt any cleanup while not in a classic environment however, as you never know what damage you might do to your resource forks.

    :1000769
Children
No Data