ANTI Variant Virus

Alias:---
Strain:ANTI Virus Strain
detected when:---
where:USA
Classification:Link virus
Length:1348 Bytes

Preconditions

Operating System(s):MacOS proprietary
Version/Release:all versions
Computer model(s):Apple Macintosh: all models
Caroname:ANTI.Variant

Attributes

Easy identification:The strings "ANTI" and "#000001" can be found in CODE 1 resource

Type of Infection:

All those having a CODE 0 and 1 resources with size of old CODE 1 + virus <= 32768 bytes.

Infection Technique:CODE 1 is increased by 1348 bytes
Infection Trigger:Running an infected application to get in memory. Use of OpenResFile.
Storage Media affected:
Interrupts hooked:OpenResFile, MountVol
Stealth:
Tunneling/Selfprot:
Oligo/Polymorphism:
Encoding Method:
Damage:Due to a programming error, the computer will hang if an infected application is executed. If MountVol is called for a disk drive, the virus searches the first sector of track 16 for the string $16+"%%S" at offset 8 from begin of sector (works only on 400K and 800K floppies); if this string is found, virus executes the code in that sector via JSR call. (No such code has been discovered until classification date)
Damage Trigger:Execution of an infected application
Particularities:---
Similarities:ANTI A, ANTI B

Agents

Countermeasures:Use an anti-viral product (public domain or commercial) such Disinfectant, Interferon, Virus detective or VirusRx to scan for virus signature.
Standard means:

Acknowledgements

Location:Virus Test Center, University Hamburg, Germany
Classification by:Ronald Greinke
Documentation by:Ronald Greinke
Date:17-December-1991
Information Source:---

(c) 1996 Virus-Test-Center, University of Hamburg