user's manual - intego · intego virusbarrier x user's manual page 12 why you need to be...

Intego VirusBarrier X User's Manual

User's Manual


Intego VirusBarrier X for Macintosh© 2000 - 2002 Intego, Inc. All Rights Reserved

Intego, Inc.

www.intego.com

This manual was written for use with Intego VirusBarrier X software forMacintosh. This manual and the Intego VirusBarrier X software described in it arecopyrighted, with all rights reserved. This manual and the Intego VirusBarrier Xsoftware may not be copied, except as otherwise provided in your software licenseor as expressly permitted in writing by Intego, Inc.

The Software is owned by Intego and its suppliers, and its structure, organizationand code are the valuable trade secrets of Intego and its suppliers. The Software isprotected by United States Copyright Law and International Treaty provisions.

Intego VirusBarrier X uses the EDCommon and EDInternet frameworks written byErik Dörnenburg.


Contents

1- About Intego VirusBarrier X ......................................................................................5What is Intego VirusBarrier X? ......................................................................................................6

Intego VirusBarrier X's Features....................................................................................................8

Using this User’s Manual ..............................................................................................................10

2 - Introduction to Computer Viruses..........................................................................11Why You Need to be Protected ....................................................................................................12

What Is a Computer Virus?...........................................................................................................12Who Writes Viruses? .................................................................................................................................. 14How Computer Viruses Work.................................................................................................................. 15

Different Types of Viruses............................................................................................................17System Viruses............................................................................................................................................. 17File Viruses ................................................................................................................................................... 19Hoaxes ........................................................................................................................................................... 23How do Viruses Spread?............................................................................................................................ 24How Can You Protect Yourself from Viruses? ...................................................................................... 25

3 - Installation...............................................................................................................27System Requirements.....................................................................................................................28

Installing Intego VirusBarrier X ..................................................................................................28

Registering Intego VirusBarrier X...............................................................................................32

Using Intego VirusBarrier X in Evaluation Mode ...................................................................33

4 - Quick Start................................................................................................................34Intego VirusBarrier X's Default Mode .......................................................................................35

Intego VirusBarrier X Interface................................................................................................................. 36

Running a Manual Scan.................................................................................................................37

NetUpdate Settings.........................................................................................................................40


Drag and Drop Scanning...............................................................................................................42

Using Intego VirusBarrier X in the Dock ..................................................................................42

5 – Intego VirusBarrier X Functions ............................................................................44Virus Scanning.................................................................................................................................45

Manual Scans ............................................................................................................................................... 45Drag and Drop Scanning ........................................................................................................................... 53Scan results ................................................................................................................................................... 53

Alerts ..................................................................................................................................................58

6 – Intego VirusBarrier X Settings ...............................................................................59Preferences ........................................................................................................................................60

Alert Options................................................................................................................................................ 66

NetUpdate .........................................................................................................................................68Virus Encyclopedia ..................................................................................................................................... 69

About Intego VirusBarrier X.........................................................................................................70

7 - Diagnosis ..................................................................................................................72If You Think You Have a Virus ...................................................................................................73

Basic precautions .............................................................................................................................74

8 - Technical support .....................................................................................................769 - Appendix ...................................................................................................................78

Glossary .............................................................................................................................................79

Virus Encyclopedia .........................................................................................................................82

Chapter 1 – About Intego VirusBarrier X


1- About Intego

VirusBarrier X



What is Intego VirusBarrier X?

Intego VirusBarrier X is the simple, fast and non-intrusive antivirus securitysolution for Macintosh computers, by Intego, the publisher of the acclaimedNetBarrier personal security software. It offers thorough protection against virusesof all types, coming from infected files or applications, whether on floppy disks,CD-Roms, removable media, or on files downloaded over the Internet or othertypes of networks.

Intego VirusBarrier X protects your computer from viruses by constantlyexamining all the files that your computer reads and writes, as well as watching forsuspicious activity that may be the sign of viruses acting on applications or otherfiles. With Intego VirusBarrier X on your computer, you can rest assured that yourMacintosh has the best protection available against viruses of all kinds.

Intego VirusBarrier X is an application that works in the background and checkseverything that your computer does, looking for viruses. It knows the uniquesignatures of all known Macintosh viruses, and whenever a new virus isdiscovered, Intego's antivirus SWAT team goes into action to provide updatedvirus definitions, which you can download automatically using IntegoVirusBarrier X's unique NetUpdate function.

When you purchase Intego VirusBarrier X, you have access to these updated virusdefinitions for one year from the date of purchase. After this time, additionalsubscriptions, allowing you to extend your access to updated virus definitions, areavailable from Intego, and can be purchased either from the Intego web site(www.intego.com) or through NetUpdate.



Intego VirusBarrier X was designed according to a few specific concepts. The mainidea is that an antivirus program should not require the user to do anything once itis installed and configured, unless a virus is detected. The Intego VirusBarrier Xphilosophy can be summed up in three words: simple, fast and non-intrusive.

SimpleIntego VirusBarrier X is the simplest, easy-to-use antivirus program. After youinstall it, it works in the background, keeping a close eye on your computer, andverifies your files silently and efficiently.

FastIntego VirusBarrier X is fast and efficient. It does not slow down your computer,and you don't need to do anything while it works. Each time a file is written, usedor opened, Intego VirusBarrier X checks the file to make sure it is safe.

Non-intrusiveIntego VirusBarrier X is non-intrusive. It will not constantly ask you about"suspicious" activity, each time you want to install a program, nor will it generateendless "false alarms". Once you have installed it, you probably won't notice it isthere, unless it detects a virus and alerts you. In addition, you do not need todeactivate Intego VirusBarrier X when installing new software, regardless of whatthe program's installer or manual may say. Intego VirusBarrier X can run all thetime, in the background, protecting your computer without you needing to worryabout it.



Intego VirusBarrier X's Features

Virus ScanningIntego VirusBarrier X works in several ways. While it is constantly watchingover your computer at all times, protecting you from any viruses, it can alsowork in manual mode, and you can ask it to scan any disk, or volume on anetwork.

Automatic RepairsIf Intego VirusBarrier X is running in automatic mode, it will repair anyinfected files it finds by eliminating the viruses, if possible, or, if not,indicating that the files are damaged. In this mode, you can just forget aboutIntego VirusBarrier X's activity—you will only know it is there if it comesacross any viruses or suspicious files.

Manual ScanYou can also use Intego VirusBarrier X to manually scan your files. This isrecommended the first time the program is installed, to make sure that yourcomputer is safe. You can then use it at any time to manually scan any disksor volumes to ensure that they are virus-free.

Turbo ModeTurbo Mode makes scanning much faster. The first time Intego VirusBarrierX scans your computer, it remembers all the files it examines. As long asthese files are not updated, Intego VirusBarrier X will not rescan them,scanning from 5 to 40 times faster.



Scan LogsIntego VirusBarrier X displays complete logs of any viruses or suspiciousfiles it finds. You can examine these logs to find out if any files orapplications are infected, were repaired, or are damaged.

DockIf you choose to keep Intego VirusBarrier X in the Dock, you can check filesor folders for viruses without even opening the application, just by draggingthem on the Intego VirusBarrier X icon.

NetUpdateIntego VirusBarrier X features Intego's unique NetUpdate program, whichallows you to check for program updates either automatically or manually.If you choose to use the automatic update function, you can set the updatefrequency, so the program checks on a given day at a given time, everyweek. If you prefer updating the program manually, a simple mouse clickconnects you to the Intego server, to check if there is a new update.

Virus AlertsIntego VirusBarrier X allows you to set alert options so you can know if theprogram detects any viruses, while working in the background. You canchoose to have the program display an alert screen, play a warning sound,or even send an e-mail message to a specific address. This can be useful ifyou want to run Intego VirusBarrier X on computers connected to anetwork, and to warn a network administrator or the computer's ownerwhen they are away from their computer.



Using this User’s Manual

This user's manual provides detailed information on installing, using and updatingIntego VirusBarrier X, as well as a complete encyclopedia of Macintosh viruses anda glossary of virus terminology.

You should start by reading the introduction to find out how computer viruseswork, and then you should follow the Installation instructions (chapter 3). Next,you should read the description of Intego VirusBarrier X's functions (chapter 5),and, if you want to know more about viruses, you can consult the VirusEncyclopedia and Glossary (chapter 9).

If you are having problems with your computer, and you think you may have avirus, you should read the Diagnosis section (chapter 7), for instructions ontroubleshooting your computer and determining whether you do, indeed, have avirus. If so, you will be instructed how to send any files that you think might beinfected to Intego's Virus Monitoring Center so we can inspect them.

Chapter 2 – Introduction to Computer Viruses


2 - Introduction to

Computer Viruses



Why You Need to be Protected

You know very well that your computer contains important information and files.If you use it for your work, you are aware how much time and money it wouldcost if you were to lose these files. Even if you use your computer just at home, youcertainly have files you would hate to lose. On top of that, if a virus were to eraseall of your files, even if you did not lose anything important, you would have tospend a great deal of time reinstalling your system and all of your programs.

An antivirus program is a kind of insurance policy. Of course, you imagine thatthis will never happen to you, but if it did, you would be very unhappy. IntegoVirusBarrier X is your insurance against all kinds of viruses, watching over yourcomputer so you don't have to worry about it.

The virus threat is real. More and more viruses are being discovered every day.While the Macintosh is relatively privileged, compared to Windows, there is stillthe danger of existing viruses or new viruses spreading to your computer anddamaging your files.

What Is a Computer Virus?

Nothing can scare a computer user more than suggesting that their computer mayhave a virus. Their reaction can be seen as that of someone who has learned thatthey, too, had caught the disease. Computer users have all heard the horror storiesabout what viruses can do, and, although some of them may be complacent, noneremain indifferent when discovering a virus on their computer.



This is even more of a problem today in our wired world, where people exchangefiles daily via e-mail. A virus on one user's computer can spread just as quickly asthis year's flu epidemic. Yet, what are computer viruses, really? How do theywork? Why are they so dangerous?

The term virus was first applied to computers in the early 1980s, when a self-replicating computer program was released "in the wild".

A virus is simply a bit of executable code that is attached to a file or application.Viruses don't get caught just from the air—they need a means of transmission,which could be a floppy disk, a CD-Rom, or a file sent over the Internet. Likeviruses that invade our bodies, computer viruses attempt to replicate, afterinfecting a host, and attach themselves to more files and applications. They clonethemselves, attack new hosts, and so on.

Viruses are basically small computer programs—the smaller the better, to hidemore easily within files and applications and escape detection. They are writtenwith only one purpose: to reproduce and spread among other computers. Whilesome viruses exist that do no damage, or merely cause a certain text to bedisplayed on screen, most do indeed harm computers and files. There have beennotable cases of viruses written without any malicious intentions, but in mostcases, viruses are written with the sole purpose of destroying files, andpropagating to other computers.

Computer viruses can infect any computer, from your home computer to yourcompany's network, unless precautions are taken. The best precaution you cantake is to use Intego VirusBarrier X, and, above all, make sure you keep it up todate.



Who Writes Viruses?

In spite of what some people say, computer viruses are not written by thecompanies that sell antivirus programs. They certainly have enough work keepingup with the viruses that are in the wild without adding to them.

No one is really sure who writes viruses—angry teenagers, skillful hackers, whoknows? Some virus writers are arrested, but this is only the tip of the iceberg. Theones that are caught may actually want the attention they get from theirviruses—many viruses have been found with the author's name in them. Othersare simply vandals, who get pleasure from seeing the havoc they can cause withtheir relatively simple programming. And still others are people who want toexperiment, to see just how far their viruses can go in the wild, how many people'scomputers will catch them. Or, are viruses simply, as one virus writer has said,"the electronic form of graffiti"?

There are even cases of viruses that had no "bad intentions", but, nevertheless,ended up causing many problems. One example of this is the MacMag virus,which tried to spread a message of world peace. See chapter 9 for a description ofthis virus.

Since the rise of the Internet, the real fear concerning viruses is no longer that oneisolated individual might try and spread a virus just for attention, but that trulymalicious people might use viruses to do economic damage on a large scale. Virusoutbreaks, such as the LoveBug virus, have shown just how much it can cost, inlost productivity and downtime, for a company to suffer a virus attack. If only forthis reason, you should protect yourself in every way possible.



How Computer Viruses Work

In the minds of most computer users, the term "computer virus" includes manytypes of "malware", not all of which are actually viruses: Trojan horses and worms,for example, work in different ways, and do not always replicate like viruses do,yet most people tend to include them as part of the virus family. While theseprograms are malicious, and can seriously damage your computer and your files,they function differently.

A real virus is a small bit of computer code, or programming instructions, that canbe executed, or run, on the type of computer it targets. For this reason, viruseswritten to attack DOS and Windows computers have no effect on Macintoshcomputers, and vice versa. (Although, if you are running one of these operatingsystems in an emulator on your Macintosh, you will have to consider thevulnerability of the emulated system to any viruses that may target it.)

Viruses do two things when activated on a computer. First, they try and executetheir code, in order to do the damage that they were designed for, and then theytry to reproduce themselves, by copying this code into other files, applications,disks or network volumes. Here is an example of what a fictional virus might doon your Macintosh. (Actually, this example presents the actions of a Trojan horse,since it will be easier to understand.)

You receive an infected program from a friend, or customer, over theInternet. Even though you have been told not to open e-mail attachmentsthat come from people you don't know, this comes from someone you trust,so you open it. Let's assume that it is an application, say, an animatedgreeting card. You double-click the file, and the application starts running.



While it is running, however, it sets off its viral code and alters your Systemfile. It copies malicious code into your System, and, at the same time,searches your company's local network for other System files, and copiesitself there as well. After the presentation is finished, you quit theapplication. Nothing happens to your computer right away, though, sincethe code is set to truly act only when you restart your computer.

The next morning, when you get to work, and start up your computer, younotice it takes longer than usual to start. When it finally starts, you find thatit is running very slowly. When you go to open that urgent report that hasto be finished by lunchtime, you notice the file is no longer there. You lookthrough your hard disk, and find that dozens, even hundreds of files aremissing. It is then that you realize that you forgot to back up your computeryesterday, and have no copies of any of these files.

In the meantime, you have already sent the animated greeting card to someother friends, but you don't realize that the two are related. It is only severalhours later that one of your friends calls, since he realized that the animatedgreeting card damaged his computer.

As you see, the consequences of this can be very serious. Not only for you, but alsofor those you are in contact with. One of the biggest problems with viruses today isthat computer users are constantly sending files to one another over the Internet,and computers can get infected much more quickly than in the past, when fileswere only sent on floppy disks. By protecting yourself with Intego VirusBarrier X,you are also protecting others as well.

Anyone who has seen the news recently is aware of the recent computer virusesthat traveled around the world in less than 24 hours. While these high-profile



viruses, such as Melissa and the Love Bug virus, affected Windows computersusing specific software, there is no reason why similar viruses could not betargeted to Macintosh computers.

Different Types of Viruses

Viruses can be broken down into two different types, according to what they targetin your computer. The first type is called system viruses, since these viruses attackthe System file, extensions, or the Desktop file. The second type, file viruses, infectapplications, data files, or even control panels and extensions.

System Viruses

System viruses are the most dangerous of all, since they can damage the operatingsystem itself. We are also including, in this section, two other types of malware:Trojan horses and worms. While not technically the same as system viruses, theytend to act more globally than file viruses.

Viruses

A computer virus is a small program that acts like a parasite, living in a host file orprogram, that is capable of infecting files and applications, reproducing itself, andspreading to other computers through infected files and applications. It is nosurprise that people use terms originally used for diseases to speak of computerviruses—they work in a very similar manner.



Viruses that attack your system are among the most lethal. The damages they cando are such that you may need to reinstall your system entirely, and even reformatyour hard drive and check all your backups to make sure they are disinfected.

Some of these viruses, such as the CDEF or WDEF viruses, only infect theMacintosh's Desktop files (on versions of Mac OS 9 and earlier). These are invisiblefiles that keep track of which icons go with which types of files and applications.These viruses, which do not affect other files, spread extremely quickly, since thefirst thing your Macintosh does when mounting a disk or volume is read itsdesktop files.

Other system viruses, such as versions of the SevenDust virus, can infect Systemfiles, control panels and applications, and at a certain time, on a certain date, deleteall non-application files on your startup disk.

Some viruses act very quickly, while others are set to go off at a certain time. Somemerely content themselves with spreading to other disks and volumes, but allsystem viruses can potentially cause damage.

Trojan Horses

The name Trojan Horse comes from an episode in the war that opposed the Greeksand the city of Troy, several millennia ago. It was a huge, hollow wooden horsethat the Greeks built and gave to the Trojans, apparently as a gift, beforesupposedly sailing away and ending the war. While some of the Trojans wereskeptical about it, the horse was taken inside their stronghold. That night, Greekwarriors emerged from the horse, opened the city gates, and Greek soldiers fromoutside stormed the city.



It is obvious that the Trojans were never told not to open attachments. The Trojanhorses that we are worried about are programs that look innocent and claim to doa certain task, but actually contain malicious code or viruses. In many cases, Trojanhorses can be even more dangerous than other viruses. Some examples areChinaTalk, which looks like a system extension but deletes folders, or the famousMacMag Trojan, which infected System files.

Worms

Worms are one of the oldest forms of viral programs on computers. They spreadby methods other than attaching themselves to files and applications, and can bevery difficult to find. The most recent serious worm on the Macintosh, called theAutoStart worm, created invisible files that could destroy data and files.

Worms use system functions to spread—the AutoStart worm spreads frominfected CD-Roms using the Autoplay function of the Mac OS. It creates invisibleextensions that activate each time the computer is restarted.

File Viruses

File viruses are different from system viruses in that they attach themselves to datafiles, rather than applications, and their hosts depend on specific programs to dotheir damage. Recent examples of file viruses, that all targeted Windowscomputers, were the very damaging Melissa and LoveBug viruses. These virusescame in attachments, which, when opened, activated certain functions built in toMicrosoft applications under Windows. In a way you could think that these wereTrojan horses, but the difference is that a Trojan horse is an application that



purports to do a certain task, whereas these file viruses were actually codeembedded into files.

Macro Viruses

In general, file viruses are macro viruses. This family of viruses poses the greatestthreat for Macintosh users today.

The first real macro virus that was found in the wild was the Concept virus, whichattacked Microsoft Word files. This was quickly followed by other variants, asvirus writers saw the potential to do great damage through the ubiquity of thisprogram. Later, macro viruses were written to exploit Microsoft Excel as well. Injust 5 years, since the appearance of this first virus, several thousand macro viruseshave been found.

The real danger of macro viruses is the fact that they are the first cross-platformviruses. For years, Macintosh users could be relatively secure from viruses,knowing that there only a few dozen viruses targeted Macintosh computers,compared to thousands for Windows. But now that macro viruses are prevalent,the danger is present.

Many programs provide the ability to create macro commands. These simpleprograms use either the internal functions of an application, such as AppleWorks,to "record" and "play back" commonly used sequences of commands. Otherapplications, such as Nisus Writer, provide a more powerful macro language,which includes both menu commands and a programming language. Programssuch as Microsoft Word and Excel base their macro functions on Visual Basic,which is similar to the Basic programming language.



One of the reasons that macro virus writers target Microsoft programs is that theseapplications allow users to embed macros in data files. In the past, one worriedonly about viruses coming through applications, since, for a virus to act, it has toexecute, and only applications could execute. But the Microsoft Visual Basicapproach is different—if you wish to use a macro, you can either run it from yourtemplate, or add it to a data file. This surprised users at first, since they thoughtthat nothing was "executed" when opening a word processor or spreadsheet file.But these files can indeed contain "programs", and do things you would neverexpect.

If the macro language provides the possibility to modify files, a macro virus will beable to copy itself into other files used by the same application. This then allowsthe virus to spread when you open other files, create new files, or pass files on tosomeone else.

Most macro viruses that target Microsoft Word files use commands such asAutoOpen, AutoClose, AutoExec and AutoExit. These are commands that areexecuted when a certain event occurs to the file, and these four events alwaysoccur when you work with a file. If, for example, a macro were written to copyitself only when you choose a certain menu command, it would be far less certainof spreading.

The most common action for macro viruses is to act when a file opens, and, first,copy itself into the template that is opened as well. You don't physically open thistemplate, but it is always open in the background—it contains certaincustomization information, such as toolbars, as well as any legitimate macros youmay have added to it.



The most common macro virus that affects Microsoft Word copies itself into theactive template, changes some menu items so you cannot edit the template,changes file types (which changes their icons, making them look like templatesthemselves), then copies itself from the corrupted template into all new files youcreate or open. This virus can be removed, if caught in time, by removing theactive template file and any infected files.

Other macro viruses can be much more dangerous. They can corrupt or deleteyour files, hide certain application functions, and even more. And, on top of allthat, they are cross-platform viruses, which can do damage both to Macintoshcomputers and PCs running Windows.

It is important to note that macro languages are very powerful tools that can beextremely helpful. Not all macros are viruses. While Microsoft Word includes apreference, to alert you if there are macros in any documents you open, this defeatsthe purpose of having a macro function. The real problem is that the macros arestored in data files, rather than, say, in separate macro files (some applications,such as Nisus Writer do this). Users could easily exchange macros, and be certainthat the files they open contain only data. Unfortunately, this approach to a macrolanguage leads users to be far too worried about macros, instead of using them fortheir function-enhancing properties.

Intego VirusBarrier X detects all known Word and Excel macro viruses, and isconstantly updated when new macro viruses are found.



Hoaxes

Hoaxes, that is, e-mail messages or newsgroup posts warning people about non-existent computer viruses, are a growing problem. While they are not virusesthemselves, they do tend to reproduce in a similar way—worried users forwardthese messages to their friends and co-workers, thinking they are true, thusmaking them worry unduly about some imaginary virus.

One of the most widespread hoaxes is called Good Times. This takes its name fromthe subject of e-mail message that is supposed to contain a virus. You might thinkthat if it were clearly such a hoax it would have not lasted very long, yet the GoodTimes "virus" message is still seen many years after its first appearance in 1994.Other copycat hoax messages are regularly circulated around the Internet as well,and you have probably already seen at least one, if not more.

These hoaxes capitalize on the lack of computer knowledge of Internet users. It istrue that they always sound serious, and sometimes seem to be forwarded frommajor computer companies. Yet they are all jokes, although not very funny ones.

If you receive a message like this, and you are worried that it might not be a hoaxbut a real virus alert, the first thing you should do, if you work in a company, iscontact your system administrator to find out if it is real. If you are a home user,you can always check the Intego web site at www.intego.com. If there are any newviruses around that you need to worry about, we will post information on our website as soon as possible. Intego's Virus Monitoring Center is ready 24 hours a day, 7days a week, and will react on the first signs of any new viruses.



If you think you have caught a new virus, see chapter 7, Diagnosis, for instructionson how to diagnose your computer, and how to contact Intego's Virus MonitoringCenter.

How do Viruses Spread?

Viruses can spread in a few basic ways. They can only spread through two things:files or removable media. Media, such as CD-Roms, Zip cartridges, etc., for theMacintosh, contain invisible files called Desktop files. These files containinformation for the System concerning file icons and applications. Viruses thatinfect Desktop files can spread when your computer reads these removable media,since the first thing your Macintosh does when mounting a disk or volume is readits desktop files. Intego VirusBarrier X protects your computer from these virusesby scanning all desktop files in removable media, before viruses have a chance tospread. If Intego VirusBarrier X detects a virus in these Desktop files, it willdisinfect them before your computer reads the files.

Viruses can also spread through infected files. These files may be on CD-Roms orother removable media, or downloaded from the Internet. They can also be sent asattachments via e-mail. Infected files cannot spread their viruses without beingopened or read. Merely copying an application cannot cause a virus to spread, butstarting up that application can. The same goes for data files—if you happen toreceive a file with a macro virus, there is nothing to worry about as long as youdon't open the file. Intego VirusBarrier X protects your computer from theseviruses by scanning files on your computer when they are written, used or opened.As soon as you do something with a file, it is scanned immediately, and if IntegoVirusBarrier X detects a virus, the file or application will be disinfected or renderedinoperable.



How Can You Protect Yourself from Viruses?

There are a few simple ways you can protect yourself from computer viruses. Thefirst, and certainly the most important, is to use Intego VirusBarrier X to constantlymonitor your computer and automatically check for viruses. Intego VirusBarrier Xprovides the best protection for your Macintosh, and works in the background, toensure that your computer remains safe.

To ensure that Intego VirusBarrier X is always watching out for all known viruses,you must update the program regularly. Intego VirusBarrier X's NetUpdatefunction makes this easy to do, even automatic, if you choose. You should checkfor updates at least once a month, and you can even check the Intego web site(www.intego.com) from time to time to see if there are any new viruses thatrequire a more immediate update.

Another very important point is that you should only use software that comesfrom reputable sources. Pirated software may contain viruses, or may be anunexpected Trojan horse. Only install software if you are sure of where it comesfrom. Intego VirusBarrier X protects you by checking each file as you installsoftware, making sure that they are safe.

In addition to this, you should be very wary of attachments or other files sent by e-mail or over the Internet. We have seen how the oldest recorded case ofnonchalantly opening an attachment led to disastrous consequences (when theTrojans “opened” the horse given to them by the Greeks). People used to say thatyou should never open attachments from people you don't know, but recentviruses on Windows computers have spread because the virus was in attachmentsthat came from friends and co-workers. In any case, if you get an attachment from



someone you don't know, you are best not opening it. But this does not ensure thatyour colleagues are unwittingly spreading viruses in their files. Intego VirusBarrierX protects you by scanning every file as you open it, and eliminating all knownviruses automatically. If you are on a network, and Intego VirusBarrier X detects avirus in an attachment, make sure you contact your network administratorimmediately, so they can remove the infected file from your company's mailserver.

In spite of all the antivirus protection provided by Intego VirusBarrier X, there stillremains one additional thing you should do to protect your data: back up yourfiles regularly. Not only should you back up important files every day, but youshould also make multiple backups of them. The media you use for backups couldget damaged or corrupted, and, in this case, your backups won't be much use.Intego Personal Backup X provides a complete backup solution, and it can evenrun backups automatically, so you can be sure to always have a safe copy of yourdata in case your Mac does get a virus.

A good way to work is the following: say you use a Zip drive to back up your files.You should use at least two different Zip cartridges for your backups, changingeach day. Think of this as insurance. Not only does this ensure that you have cleancopies of your files if you find a virus on your computer, but it also protects yourdata from any other types of problems, such as hard disk crashes, etc. Given therelatively low cost of removable media, or even writable CD-Roms or external harddisks, you should also back up your System and applications as well, although youdon't need to do this as often. Remember, if, for some reason, your computer getscorrupted, it will take you a long time to reinstall your system and applications. Ifyou back up your entire computer, you will be able to do this in just a few minutes.

Chapter 3 – Installation


3 - Installation



System Requirements

• Any officially-supported Mac OS X compatible computer• Mac OS X 10.1.1 or higher, or Mac OS X Server 10.1.1 or higher• 20 MB free hard disk space• Minimum screen resolution 800 x 600

Installing Intego VirusBarrier X

Installing Intego VirusBarrier X is very simple. Insert the Intego VirusBarrier XCD-ROM in your computer's CD-ROM drive. A window will open, containing theIntego VirusBarrier X installer, the Read me file, the Intego VirusBarrier X manual(this file), and an Acrobat Reader installer. (If you purchased a download versionof Intego VirusBarrier X, you will have a disk image file called VirusBarrier XInstall.dmg. Double-click this file to open the disk image, which will mount on thedesktop.)

First, read the Read me file, for any late-breaking changes.

Then, double-click the Intego VirusBarrier X installer.



Two options are available with this installer: installation and uninstallation.

To install Intego VirusBarrier X, click Install. To uninstall Intego VirusBarrier X,click Uninstall.

You will see a window displayed informing you that you must enter anadministrator’s password to install Intego VirusBarrier X. Click the lock to enteryour password, or enter your password in the dialogue that is displayed (OS X10.2 or later). Enter your password, then click OK. The following window will bedisplayed:



Click Continue to proceed with installation. The Intego software license will bedisplayed. Click Continue, then click Agree if you accept this license; if not, clickDisagree, and the installer will quit.

The next window will show all the available disks or volumes on your computer.Select the disk or volume where you want to install Intego VirusBarrier X thenclick Continue.

Click Install to install Intego VirusBarrier X. This will perform a basic installation.If you wish to perform a custom installation, click Customize. The followingwindow will be displayed:



This window lets you choose which items will be installed. As you can see, theCommon Intego Services check box is grayed out, because this must be installed.You have the choice of installing either Intego VirusBarrier X, NetUpdate or both.If you already have other Intego programs installed on your computer, you willsee the option to Upgrade the installation—this means that certain componentsused by all Intego programs will not be reinstalled.

After installation, you will have to restart your computer.



Registering Intego VirusBarrier X

When you restart your computer, open Intego VirusBarrier X - it is found in yourApplications folder. Intego VirusBarrier X will open its Registration program, anddisplay the following window:

Since Mac OS X is a multi-user operating system, not all users have the sameprivileges. When starting up Intego VirusBarrier X for the first time, any user canenter the serial number, but only a user with administrator privileges canconfigure the program.

You must enter your name, company, if any, and your serial number. The serialnumber is found on a sticker on the Intego VirusBarrier X CD. When registration is



completed, Intego VirusBarrier X will open, and, if you are an administrator, youcan configure the program.

Using Intego VirusBarrier X in Evaluation Mode

Intego VirusBarrier X offers an evaluation mode, to allow you to discover how itworks before purchasing the program. To use Intego VirusBarrier X in evaluationmode, click Cancel when the registration screen displays. Intego VirusBarrier Xthen displays a screen asking if you want to run the program in Evaluation mode.If you do, click Evaluation mode; if not, click Cancel.

Chapter 4 – Quick Start


4 - Quick Start



Intego VirusBarrier X's Default Mode

When you install Intego VirusBarrier X, and restart your Macintosh, itautomatically begins watching over your computer. Intego VirusBarrier X isdesigned to be simple and non-intrusive, and it fully protects your computerwithout your doing anything at all.

Once the program is installed, you can just let it run on its own. However, it isrecommended that you either set the NetUpdate function to make automaticchecks, to find if the program has been updated, or that you make manual checksat least once a month.

To open Intego VirusBarrier X, and change any of the settings, or run a manualscan, find the Intego VirusBarrier X icon in the Applications folder, and double-click it.



Intego VirusBarrier X Interface

The Intego VirusBarrier X application looks like this. It contains the Orb, thecontextual control button, and several other buttons for choosing settings orrunning scans. To access any of these functions, click on one of the buttons on theinterface, and a drawer will open.

To close the drawer, click on the same button or on the triangle at the right of thedrawer. You can also click on another button to close the current drawer and openthe drawer corresponding to the new button.

The Intego VirusBarrier X OrbThis gives you information about the current operation.

The contextual Control buttonThis button changes according to the function it can have, suchas Scan, Pause, Stop etc.

The Scanner buttonThis button lets you select a volume, folder or file to scan forviruses.

The Log buttonThis button opens a list of logs, showing you the dates andtimes of any manual scans and any infected or damaged filesfound.

The NetUpdate buttonThis button lets you check for updates to Intego VirusBarrier X.

The Preferences buttonThis button lets you choose other settings for IntegoVirusBarrier X.

The About buttonThis button gives you information about Intego VirusBarrier X.



Running a Manual Scan

Once Intego VirusBarrier X is installed, it watches over your files ensuring thatthey are safe from viruses. But Intego VirusBarrier X checks files as they are read,used or written. The installation procedure gives you the option to run a manualscan of all your files right after installation to make sure your entire computer isdisinfected. You should do this, to ensure that you don't have any infected files.After that, Intego VirusBarrier X makes sure that any new files are safe.

If you did not choose to run a manual scan after installation, or to run a manualscan at any time, open Intego VirusBarrier X by double-clicking its icon in theApplications folder.

Click the Select button, and a drawer will open showing all of the volumescurrently mounted on your computer. This view is similar to a Finder list view,showing volumes, folders and files according to their hierarchy. To expand avolume or folder, and view its contents, click the triangle to its left, and all the filesand folders it contains will be displayed below it. To collapse an open volume orfolder, click the triangle to close it.



To run a manual scan on any of your volumes, folders or files, double-click theitem you wish to scan, or click it once to select it, and click the Scan button. Youwill see from the activity in the Orb that scanning has begun. The Orb first displaysthe number of files scanned as it works.

If you have selected Show files left in the Preferences, Intego VirusBarrier X countshow many files are to be scanned, then displays the number of files left and the



percentage of the scan remaining. If you click the Orb, the display will change toshow the number of files scanned, and the corresponding percentage.

You can stop the scan at any time by pressing the Stop button. If you wish to pausethe scan, hold down the Shift key on your keyboard, and you will notice that theStop button now displays Pause. Click this button, and scanning will pause.

To resume scanning, click this button, which now shows Resume.



NetUpdate Settings

If you click the NetUpdate button, the NetUpdate drawer opens. This drawer letsyou check for updates, and also gives you information on the last time youchecked, the version number of Intego VirusBarrier X, and your subscription limit.When you purchase Intego VirusBarrier X, you have access to updates andupdated virus definitions for one year from the date of purchase.



It is essential that you make regular updates to Intego VirusBarrier X, to ensurethat you are protected from the latest viruses. Intego VirusBarrier X includesIntego's NetUpdate, which can check automatically to see if the program has beenupdated, and download the update for you.

To check for updates, click the Check… button. Intego NetUpdate will open andwill connect to Intego’s server to check for updates to the program or to virusdefinitions. When you purchase Intego VirusBarrier X, you have access to updatesand these updated virus definitions for one year from the date of purchase.

You can set NetUpdate settings, such as choosing days and times for automaticupdates, from the NetUpdate Preferences Pane in the System Preferences.

For more on NetUpdate, see chapter 6, Intego VirusBarrier X Settings and see theNetUpdate manual.



Drag and Drop Scanning

You can also scan any volume, folder or file by dragging it on to any part of theVirusBarrier interface. Once you release the item to be scanned, VirusBarrier willstart scanning it, the same as for any other manual scan.

Using Intego VirusBarrier X in the Dock

After you open Intego VirusBarrier X, you will see its icon in the Dock.

If you click this icon, and select Keep in Dock from the menu that appears, the iconwill remain in the Dock even after you quit the application.



The Intego VirusBarrier X icon will be green when the application is open, and redwhen it is not open.

You can drag files, folders or volumes onto the Intego VirusBarrier X icon at anytime in the Dock, and Intego VirusBarrier X will open the application and begin tocheck the files. The Orb will show the status of the current verification in the Dock.

If you check Hide application at startup in the Preferences, the Intego VirusBarrierX application will not become visible, and all action will be shown in the Orb in theDock. For more on preferences, see chapter 6, Intego VirusBarrier X Settings.

Chapter 5 – Intego VirusBarrier X Functions


5 – Intego VirusBarrier X

Functions



Intego VirusBarrier X is a powerful easy-to-use program that protects yourcomputer from all types of viruses. It works in the background, providing yousilent and efficient protection all the time.

Virus Scanning

Intego VirusBarrier X works in several ways. It constantly watches over yourcomputer at all times, protecting you from viruses, and it automatically checks allremovable media, as soon as it is inserted into its drive, whether CD-Roms, Zipcartridges, or any other media. It can also work in manual mode, allowing you toscan any computer, disk, or volume on your computer or on a network.

Manual Scans

The first time you use Intego VirusBarrier X, you should run a manual scan on allof your computer's hard disks or volumes. This ensures that there are no viruseshiding on your computer. This can be done automatically after programinstallation. To find out how to do this, see chapter 3, Installation.

You can also run a manual scan on any volume, folder or file, at any time. To dothis, open Intego VirusBarrier X, and click the Select button.



A drawer will open showing all of the volumes currently mounted on yourcomputer. This view is similar to a Finder list view, showing volumes, folders andfiles according to their hierarchy. To expand a volume or folder, and view itscontents, click the triangle to its left, and all the files and folders it contains will bedisplayed below it. To collapse an open volume or folder, click the triangle to closeit.



Scanning a Volume

To scan a volume, just double-click it, or click it once to select it, and click the Scanbutton. You will see from the activity in the Orb that scanning has begun. The Orbfirst displays the number of files scanned as it works.

If you have selected Show files left in the Preferences, Intego VirusBarrier X countshow many files are to be scanned, then displays the number of files left and thepercentage of the scan remaining. If you click the Orb, the display will change toshow the number of files scanned, and the corresponding percentage.



You can stop the scan at any time by pressing the Stop button.

If you wish to pause the scan, hold down the Shift key on your keyboard, and youwill notice that the Stop button now displays Pause. Click this button, andscanning will pause.




Scanning a Folder

To scan any folder on your computer, click the triangle at the left of a volume, andnavigate in this manner until you find the folder you want to scan. Double-clickthis folder, or click it once to select it, then click the Scan button. You will see fromthe activity in the Orb that scanning has begun. The Orb first displays the numberof files scanned as it works.

If you have selected Show files left in the Preferences, Intego VirusBarrier X countshow many files are to be scanned, then displays the number of files left and thepercentage of the scan remaining. If you click the Orb, the display will change toshow the number of files scanned, and the corresponding percentage.



You can stop the scan at any time by pressing the Stop button.

If you wish to pause the scan, hold down the Shift key on your keyboard, and youwill notice that the Stop button now displays Pause. Click this button, andscanning will pause.




Scanning a File

To scan any folder on your computer, click the triangle at the left of a volume, andnavigate in this manner until you find the file you want to scan. Double-click thisfile, or click it once to select it, then click the Scan button. You will see from theactivity in the Orb that scanning has begun, but, in most cases, if you are scanningjust one file, the scan will be completed almost immediately.



Drag and Drop Scanning

You can also scan any volume, folder or file by dragging it on to any part of theVirusBarrier interface. Once you release the item to be scanned, VirusBarrier willstart scanning it, the same as for any other manual scan.

Scan results

If Intego VirusBarrier X finds any infected files, the Log window will open,showing the names of any infected files, and the type of viruses they are infectedwith. If you have asked Intego VirusBarrier X to scan only, and not repair, anyinfected files will be shown here, and the type of viruses they have. If IntegoVirusBarrier X is set to repair files automatically, you will see the names of anyrepaired files, and what type of viruses they had.



Understanding Scan Results

Intego VirusBarrier X will inform you if it finds any files infected by any knownviruses. It will also alert you if any damaged files are found.

Infected Files

If any infected files are found, the Intego VirusBarrier X Orb will turn red, and theLog drawer will open. This drawer will open as soon as an infected file is found, sothe scan may still be going on when this drawer opens. Intego VirusBarrier X willalso alert you, according to the alert options you have set in the Preferences. Formore on alert options, see chapter 6, Intego VirusBarrier X Settings.

The display in the Log drawer will also depend on the Scan mode you haveselected in the Preferences. You have the choice between having IntegoVirusBarrier X make automatic repairs (Repair mode), or merely alerting youwhen infected or damaged files are found (Scan mode). If you have chosen Repairmode, repairs will be made immediately, if possible. If you have chosen Scanmode, repairs must be made manually. For more on Repair mode and Scan mode,see chapter 6, Intego VirusBarrier X Settings.



If you have chosen Scan mode, the Log drawer will show the name(s) of the file(s)that are infected. To repair a file or files, select the items you wish to repair, andclick the Repair button at the bottom of the window. The file will be repaired, andthe Log drawer will show this change. To view any of these files shown in theFinder, click a file to select it and click Reveal in Finder.



Corrupted Files

If any corrupted files are found, the Intego VirusBarrier X Log drawer will open.This drawer will open as soon as a damaged file is found, so the scan may still begoing on when this drawer opens. Intego VirusBarrier X will also alert you,according to the alert options you have set in the Preferences. For more on alertoptions, see chapter 6, Intego VirusBarrier X Settings.

Corrupted files may not contain viruses, but many viruses can damage files, evenif they do not copy themselves to these files. These files could also have beendamaged by such things as disk errors, or crashes when files are open. If anydamaged files are found, you should replace them as soon as possible.



Alerts

While Intego VirusBarrier X can be used to run manual scans, as seen above, itusually works in the background. It has several ways of alerting you if it finds anyinfected files.

If VirusBarrier detects any infected files, and you have set it to scan, and notautomatically repair infected files, it will display an alert.

If you want VirusBarrier to repair the file, click Repair. If not, click Ignore thisalert; the file will not be repaired. Warning: this can be dangerous! Only select tonot repair files if you are sure of what you are doing!

For more on setting Alert preferences, see chapter 6, Intego VirusBarrier X settings.

Chapter 6 – Intego VirusBarrier X Settings


6 – Intego VirusBarrier X

Settings



Preferences

If you click the Preferences button on the Intego VirusBarrier X interface, or selectPreferences… from the Intego VirusBarrier X menu, you can set several differentoptions. The first tab lets you set Scan Mode options, and the second lets you setseveral alert options.



Scan Mode

This tab lets you set options concerning the way Intego VirusBarrier X scans forviruses, and other options concerning the information provided in the Orb.

Modes

This section lets you choose the scanning mode and whether the application isvisible at startup.

Intego VirusBarrier X lets you choose between two virus scanning modes: Scanmode and Repair mode. If you select Scan mode, Intego VirusBarrier X will alertyou any time it finds infected files, but will not automatically repair the files bydisinfecting them. If a file is found during a scan, Intego VirusBarrier X will alertyou, or, if you are running a manual scan, the Log will display the infected file, butyou will need to repair the file manually. This may be useful if you are on anetwork, and your network administrator will need to examine any infected filesyou might find.

To select the Scan mode you wish to use, click the appropriate radio button.

If you check Hide Application at startup, Intego VirusBarrier X will appear in theDock when you start up the application, but the application itself will not be



visible. You can scan files, folders or volumes by dragging them on the IntegoVirusBarrier X icon in the Dock. If Intego VirusBarrier X discovers any virusesduring these scans, you will be alerted, according to the choices made on the Alertstab.

Options

Several other options are available which control the way Intego VirusBarrier Xfunctions.

Turbo Mode

If you check the Turbo Mode check box, Intego VirusBarrier X will scanyour files more quickly. The first time Intego VirusBarrier X scans yourcomputer, it remembers all the files it examines. As long as these files arenot updated, Intego VirusBarrier X will not rescan them, scanning from 5 to40 times faster. However, if any of these files are modified they will bescanned. Also, when updating Intego VirusBarrier X for new virusdefinitions, all files will be scanned to ensure that all your files are free of allknown viruses.



Show Files Left

If you check this option, the Intego VirusBarrier X Orb will show thenumber of files left to be checked when scanning files, rather than thenumber of files that have been scanned.

Compressed Files

If you check Compressed Files, Intego VirusBarrier X will scan compressedfiles contained in Stuffit archives. When scanning compressed files in StuffitArchives, you will see a dialog box displayed briefly as the archive isexamined, and any infected or corrupted files contained in an archive willbe signaled. To repair or disinfect these files, you will need to decompressthe archive, repair or disinfect the files by dragging them (files or folder)onto the Intego VirusBarrier X orb, and delete the original infected orcorrupted archive.

Show Invisible Files in Browser

If you check this option, Intego VirusBarrier X will display invisible files inthe browser drawer.



SoundsIntego VirusBarrier X can play sounds to notify you of four events:

• Virus detected• Virus eradicated• Corrupted file• No virus detected

Choose from the default sounds, which use synthesized voices to inform you ofthese events, or select any other sound available on your computer by selecting itfrom the popup menu.



Alerts

This tab gives you several options as to how Intego VirusBarrier X will act whenpresenting an Alert.



Alert Options

There are three options for the way Intego VirusBarrier X alerts you to any virusesfound in your files when working in the background.

Repair and show alertIf this is checked, Intego VirusBarrier X repairs infected files automaticallyand displays an alert to inform you of the name of the infected file and thevirus found.

Repair and log onlyIf this is checked, Intego VirusBarrier X repairs infected files automaticallyand records the name of the infected file and the virus found in its log. Itwill not alert you, and you must check the log to find if any infected files arefound.

Show alertIf this is checked, Intego VirusBarrier X displays an alert to inform you ofthe name of the infected file and the virus found. The alert asks whether youwant to repair the infected file or not.



Options

Send e-mailIf this is checked, Intego VirusBarrier X will automatically send an e-mailmessage to the address entered in the text field, within 30 seconds. The e-mail address for the sender and recipient must be entered, as well as theoutgoing mail server. You can send this e-mail message to multiplerecipients. To do this, enter several e-mail addresses separated by commas.



NetUpdate

If you click the NetUpdate button, the NetUpdate drawer opens. This drawer letsyou check for updates, and also gives you information on the last time youchecked, the version number of Intego VirusBarrier X, and your subscription limit.When you purchase Intego VirusBarrier X, you have access to updates andupdated virus definitions for one year from the date of purchase.



To check for updates, click the Check… button. Intego NetUpdate will open andwill connect to Intego’s server to check for updates to the program or to virusdefinitions. When you purchase Intego VirusBarrier X, you have access to theseupdated virus definitions for one year from the date of purchase.

You can set NetUpdate settings, such as choosing days and times for automaticupdates, from the NetUpdate Preferences Pane in the System Preferences.

For more on NetUpdate, and NetUpdate Settings, see the NetUpdate manual.

Virus Encyclopedia

The second tab in this drawer, Virus Definitions, contains a Virus Encyclopedia,with a complete history of many of the Macintosh viruses that VirusBarrierprotects you from.



About Intego VirusBarrier X

This drawer gives information about Intego VirusBarrier X, such as the versionnumber, your support number (a number you will need for technical support),clickable links to Intego’s web site and e-mail address, and Intego’s address andtelephone number.



If you wish to contact Intego with any questions, click the Contact link, and your e-mail program will create a new message to Intego, with a subject "message fromclient #" followed by your client number. You can then type the text of yourmessage, and send it to Intego right away.

If you need to contact Intego for technical support, click the Support link. Your e-mail program will create a new message to Intego, with a subject "support messagefrom client #" followed by your client number. You can then type the text of yourmessage, and send it to Intego right away.

Clicking the Register online link will take you to the Intego VirusBarrier Xregistration page on the Intego web site. It is important to register your software,so Intego can keep you up-to-date on the latest information concerning IntegoVirusBarrier X and its other products.

Clicking the Web Site link will take you to the Intego web site.

Chapter 7 – Diagnosis


7 - Diagnosis



If You Think You Have a Virus

Some Symptoms of Infection

While the presence of these symptoms does not necessarily mean that a virus hasattacked your computer, they could be signs of a viral attack:

• unexpected error messages,• your Macintosh “crashes” inexplicably,• your hard disks or floppy disks are being read for no reason,• your system seems to be running unusually slowly,• your disk space seems to have reduced significantly, even though you have

not added many files.

If your computer starts showing any of the above symptoms, there are severalthings you can do to check if the problem comes from a virus or from othersoftware problems.

First, you should run Apple's Disk Utility program. This program is designed todiagnose problems that you may have with your computer's hard disk, and repairmost of them. It is installed by default in the Utilities folder of your Applicationsfolder. If Disk Utility finds problems that it cannot repair, you will need acommercial disk maintenance program.

If this does not solve your problem, you should think about any recently installedsoftware. Most problems with computers come from software conflicts. If you haverecently installed any new software, try uninstalling the software, and see if theproblem persists.



Your problem may come from other hardware, such as external drives, any USBhardware you may have connected to your computer, your printer driver, etc.Again, see if the problem continues when these devices and their drivers areactivated.

For more help, you can go to the Support section of the Apple web site(www.apple.com) to see if there is a solution for your problem.

As a last resort, if you think that you have an infected file, you can send a copy ofthe file to the Intego Virus Monitoring Center. For information on this, see chapter8, Technical Support.

Basic precautions

Even though Intego VirusBarrier X is now keeping a close eye on your Macintosh,you should still get into the habit of respecting a few basic principles to make surethat your files will always be protected.

• Make regular backups of your files. Use Intego Personal Backup X to runautomatic backups.

• Make several copies of your most important files.• When your removable media “travel” to other computers, or if you lend

them to other people, make sure they are write-protected by sliding thewrite-protection tabs (if possible).

• Do not deactivate Intego VirusBarrier X unless you absolutely must: you donot need to deactivate Rival to install new applications, even though mostinstallation programs request this.



• Do not use pirated software: not only is it against the law, but theseprograms often carry viruses, because they travel from one computer toanother.

• With this in mind, only install programs if you are sure that the originalpackaging has not been tampered with.

• Think about using NetUpdate to verify that your version of IntegoVirusBarrier X is up-to-date, and do this regularly, to make sure you havethe latest version.

• To ensure that there is no incompatibility, use only Intego VirusBarrier X toprotect your computer against viruses.

Chapter 8 – Technical Support


8 - Technical support

Chapter 8 – Technical Support


Technical support is available for registered purchasers of Intego VirusBarrier X.

By [email protected]

From the Intego web sitewww.intego.com

To send files to the Intego Virus Monitoring Center, contact [email protected].

Chapter 9 - Appendix


9 - Appendix



Glossary

Antivirus – An antivirus is a program that protects your computer from viruses byscanning, disinfecting and repairing infected files. It looks for bits of code thatmake up the virus's "signature", in certain places in files and applications.Archive – An archive is a file that contains several files, and is usually compressed,to save space. The standard for compression on the Macintosh is Stuffit.Boot – Booting a computer means starting it up. It comes from the word bootstrap,as in "pulling yourself up by your bootstraps".Code – Computer programs are written in code, or programming languages.Viruses, since they too are computer programs, are also written in code.Desktop File – Desktop files are invisible files that keep track of which icons gowith which types of files and applications. Every volume, or disk, on yourcomputer has invisible desktop files, called, under MacOS 9, Desktop DB andDesktop DF. Certain old viruses target desktop files, since your computerautomatically reads these files whenever you insert any removable media into adrive.Extension – Extensions (also called inits), like control panels, are part of theMacintosh operating system. They add functions to the basic system, or are used asdrivers for specific hardware. There are two types of extensions: those that getloaded along with the system when you boot your computer, and those that arecalled upon when needed by the system.Infect – If a file is infected, this means that a virus has copied itself onto the file.This may be a macro, copied onto a word processor file, or other types of code,copied onto an application.Hoax – A hoax is a virus warning that is not true. There are many hoaxes thatcirculate by e-mail, and they all talk of getting a virus by merely reading an e-mailmessage.



INIT – An init is another name for an extension. This term comes from the fact thatthese files are initialized when the computers boots.Macro – A macro is a short program that uses the built-in functions of a givenapplication's macro language. Many applications have macro functions, designedto let you carry out repetitive functions more easily. Unfortunately, macros alsocan do damage to your system, and there are many macro viruses in the wild,especially those that run under Microsoft Word or Excel.Macro Command – A macro command is a small programming command that isaccessible in a macro. It uses a macro language that is specific to a givenapplication.Macro Virus – A virus that takes advantage of an application's built-in macrolanguage. Macro viruses are currently the most dangerous viruses for Macintoshusers, especially those that run under Microsoft Word or Excel, since they can betransmitted from Macintosh computers to Windows computers.Partition – A partition, or volume, is a logical part of a hard disk. It is possible tocreate many partitions on a hard disk, each of which functions as if it were asmaller hard drive. The operating system sees partitions as separate volumes.Resource – Macintosh files have two parts: a resource fork and a data fork. Theresource fork can contain such elements as icons, code, or other instructions forapplications. Some viruses hide in resources, or corrupt or change resources.Removable Media –Any data storage media that is inserted into a drive, such as aCD-Rom, a Zip cartridge, or a floppy disk.Strain – A strain of a virus is a variation or mutation of a certain virus. Just as thisterm is used in medicine, for mutations of bio-viruses, it is also used for computerviruses, which can, in some cases, mutate, creating new strains.Trojan Horse – A Trojan horse, or Trojan, for short, is a program which, in reality,hides some sort of malicious code. It is not really a virus, since it does notreproduce, but it may contain viral code, which, when the Trojan is run, will copyitself into other files. The name Trojan Horse comes from the huge, hollow wooden



horse that the Greeks built and gave to the Trojans, apparently as a gift. The horsewas taken inside their stronghold, and, later that night, Greek warriors emergedfrom the horse, opened the city gates, and Greek soldiers from outside stormed thecity.Virus – A computer program, or a bit of computer code, capable of reproducingand propagating. Most viruses are malicious, and infect files by attaching to them.They then use these host files to spread when the files are open or run.Volume – A volume is, in essence, a hard drive, or other removable media unit. Itcan be an entire hard disk, a partition on a hard disk, a remote computer on anetwork, or a floppy disk. What is special about a volume is that it contains its owndirectory files indicating where, on the volume, files are stored.Worm – A worm is a program that propagates itself over a network, reproducingitself as it goes. While most people tend to consider that a worm is just a kind ofvirus, since worms can be capable of malicious activities, they do not function thesame way. Worms do not need host files to reproduce.



Virus Encyclopedia

ANTI

The ANTI virus originated in France, in 1989. The first strain discovered was calledANTI-A, and a second strain, ANTI-B, was discovered in 1990. This virus infectedapplications, but not the System or data files. It is only effective under System 6.

The ANTI virus, whose name comes from the text string "ANTI" found in thevirus, was a relatively dangerous virus, since it damaged applications, causingthem to crash. Applications damaged by the ANTI virus cannot be repaired, andmust therefore be reinstalled. This damage seems to have been accidental,however, since the virus only tries to reproduce, and has no other effects.

It seems that the ANTI-B strain was probably written before the ANTI-A strain,since ANTI-A contains code that neutralizes ANTI-B. Other than this, there is littledifference between the two strains.

AUTOSTART Worms

In May 1985, the first worm infecting Macintosh computers was found. It spreadquickly through south-eastern Asia, and then spread throughout the world. Thereare several variants of this worm: AutoStart 9805-A, B, C, D, E and F.

This worm spreads easily through Macintosh computers with QuickTime's "CD-ROM AutoPlay" function enabled, if an infected CD-Rom is read by the computer.It copies itself to the host computer, creating invisible files in the Extensions folder,



called Desktop Print Spooler, Desktop Printr Spooler, or DELDesktop PrintSpooler.

This worm can cause serious damage to your computer, by deleting files anddestroying data. The different strains target different types of files, and damagedfiles are overwritten with garbage data, and cannot be repaired or recovered.Infected computers show a great deal of unusual disk activity every 3, 6, 10 or 30minutes, and may show Desktop Print Spooler in the Applications menu.

CDEF

The CDEF virus was first found in 1990, in Ithaca, New York. The author of thisvirus, who also wrote the WDEF virus, was arrested shortly after it wasdiscovered. Its name comes from the fact that it used a CDEF resource, found inthe Macintosh Desktop file, to reproduce. CDEF resources are normally found incertain applications, as well as the System file, so the presence of this resource doesnot mean that a file is infected. This resource is not, however, normally found inDesktop files.

This virus only infected Desktop files, and could spread very easily from disk todisk, since the Macintosh reads the Desktop files of every disk when mounted. Thevirus did not do any intentional damage, but, like many other viruses, could stillbe dangerous.

A second version of the CDEF virus was found in 1993, and this new strain hadonly minor differences with the original.



CODE 1

CODE-1 was first discovered in the United States in 1993. This virus was nothighly destructive, and infected the System file and applications. It renamed thestartup volume "Trent Saburo" if the computer was started up on any October 31.While it could spread to other computers, the only damage it could cause wascrashes of the System and of certain applications.

CODE 252

The CODE 252 virus was first discovered in the United States in 1992. It infectedboth the System file and applications, and would display the following message onan infected computer started up between June 6 and December 31:

You have a virus.Ha Ha Ha Ha Ha Ha HaNow erasing all disks...Ha Ha Ha Ha Ha Ha HaP.S. Have a nice dayHa Ha Ha Ha Ha Ha Ha (Click to continue...)

In spite of this message, the virus did not delete any files. At any other time of theyear (before June 6), the virus would merely copy itself from applications to theSystem file, and then from there to other applications. Crashes and damaged fileswere seen under System 7, but under this system version, it would not spread toany other applications. This poorly-written virus would, however, cause othercrashes and damage, since its code contains several errors.



CODE 9811

The CODE 9811 virus was discovered in November 1998 in Sweden. It hidesapplications and replaces them with garbage files, with names containing randomletters. On Mondays, the virus has a 25% probability of displaying a message, "Youhave been hacked by the Praetorians", and makes the infected computer's desktoplook like electric worms. This virus also attempts to delete any antivirus softwareon the startup volume.

CODE 32767

This rare virus, that may no longer be in circulation, was discovered in 1997, andattempts to delete documents once a month.

Flag

The Flag virus (also called the WDEF-C virus) infects the System file, and, whilenot seeking to do any major damage, overwrites the WDEF resource with ID 0.This action may cause damage. This virus may no longer be in circulation.

Frankie

The Frankie virus, which comes from Germany, is a rare virus that only attackscertain Macintosh emulators running on Atari or Amiga computers. It seems totarget pirated emulator software, and displays a message, "Frankie says: No morepiracy!", and causes the Atari to crash. It does not affect Macintosh computers, butinfects applications, and copies of infected applications may cause this virus tospread to other copies of the emulator.



Graphics Accelerator

See SevenDust.

INIT-M

The INIT-M virus was first discovered in the United States in 1993. It is a verydangerous virus, and is set to trigger on any Friday the 13th. It can damage largenumbers of folders and files, changing their names to random strings of characters.It also charges file creators and types to random 4 character strings, which changesthe files' icons, rendering them unusable, unless this information is changed backto the original. It resets the files' creation and modification dates to January 1, 1904.In some cases, the virus deletes files, and can also cause erratic window display.

This virus can infect all types of files, and also creates a file called "FSV Prefs" inthe Preferences folder.

INIT 17

INIT 17 was first discovered in Canada in 1993. It infects the System file andapplications. When infected computers were started up after 6:06:06 am, anOctober 31, 1993, this virus would display the message, "From the depths ofCyberspace". After this message was displayed, it was not displayed again.

It contained many errors, and could cause crashes on some 68000 Macintoshcomputers. This damage was more accidental than intentional.



INIT 29

This virus was first discovered in 1988, and a second strain was found in 1994.They are sometimes called INIT 29 A and INIT 29 B respectively.

This is an extremely dangerous virus, that infects system files, application files,and documents, although infected documents could not infect other files.

While this virus does no intentional damage, other than trying to spread, it willdisplay the following message if you insert a locked floppy disk into yourcomputer:

The disk "xxxx" needs minor repairs.Do you want to repair it?

In addition, various types of problems have been seen on infected computers,including crashes, miscellaneous errors, and printing problems.

INIT 1984

The INIT 1984 virus was discovered in 1992 in the Netherlands and the UnitedStates. Like many other viruses, it triggers if an infected computer is started up ona Friday the 13th. Like the INIT-M virus, it can damage large numbers of foldersand files, changing their names to random strings of characters. It also charges filecreators and types to random 4 character strings, which changes the files' icons,rendering them unusable, unless this information is changed back to the original. Itresets the files' creation and modification dates to January 1, 1904.



This virus only infects INITs (or extensions), and does not infect any other type offile. It does not spread as rapidly as other viruses that affect applications, sinceINITs are not passed around from one computer to another very often.

INIT 9403

This virus, also called the SysX virus, was first seen in Italy in 1994. It currentlyonly affects Macintoshes running an Italian version of the System software. It isvery dangerous, deleting files, and attempting to erase currently-mounted disks. Itseems that this virus was spread through pirated software, and infects the Finder,as well as certain compacting and archiving programs.

Macro Viruses

Macro viruses pose the greatest threat for Macintosh users today.

The first real macro virus that was found in the wild was the Concept virus, whichattacked Microsoft Word files. This was quickly followed by other variants, asvirus writers saw the potential to do great damage through the ubiquity of thisprogram. Later, macro viruses were written to exploit Microsoft Excel as well. Injust 5 years, since the appearance of this first virus, several thousand macro viruseshave been found.

The real danger of macro viruses is the fact that they are the first cross-platformviruses. For years, Macintosh users could be relatively secure concerning viruses,knowing that only a few dozen viruses targeted Macintosh computers, comparedto thousands for Windows. But, now that macro viruses are prevalent, the dangeris more present.



Most macro viruses, that target Microsoft Word files, use commands such asAutoOpen, AutoClose, AutoExec and AutoExit. These are commands that areexecuted when a certain event occurs to the file, and these four events are thosewhich always occur when you work with a file. If, for example, a macro werewritten to copy itself only when you choose a certain menu command, it would befar less certain of spreading.

The most common action for macro viruses is to act when a file opens, and, first,copy itself into the template that is opened as well. You don't physically open thistemplate, but it is always open in the background—it contains certaincustomization information, such as toolbars, as well as any legitimate macros youmay have added to it.

The most common macro virus that affects Microsoft Word copies itself into theactive template, changes some menu items, so you cannot edit the template,changes file types (which changes their icons, making them look like templatesthemselves), then copies itself from the corrupted template into all new files youcreate or open. This virus can be removed, if caught in time, by removing theactive template file, and any infected files.

Other macro viruses can be much more dangerous. They can corrupt or deleteyour files, hide certain application functions, and even more. And, on top of allthat, they are cross-platform viruses, which can do damage both to Macintoshcomputers and PCs running Windows.

MacMag

The MacMag virus is an example of good intentions gone wrong. It was written forthe MacMag magazine, and was designed to display a message of peace, when an



infected computer was started up on March 2, 1988, and then delete itself. It wasoriginally in a HyperCard stack called New Apple Products (which, itself, wastherefore a Trojan horse), and spread by infecting the System file. It is probably notin circulation any more, but may be found on old disks and CD-Roms.

MBDF

This virus was first discovered in Wales, in 1992, thanks to the internal viruschecking function of Claris applications. It was originally transmitted in gamescalled 10 Tile Puzzle and Obnoxious Tetris, and a Trojan horses, called Tetricycle.Unlike most viruses, the MBDF virus led to the arrest and conviction of twoAmerican college students.

The virus infects both applications and the System file, by copying an MBDFresource with ID 0. If, however, the System file already has a resource with thisname, it will not be changed.

While this virus is not malicious, it can damage the System file, causing the user tohave to reinstall it. It also causes certain menu-related problems. Two strains ofthis virus exist, MBDF A and MBDF B, which are essentially the same.

MDEF

Foun strains of the MDEF virus exist: A, B, C, and D. The A strain is sometimescalled the Garfield virus, and the B strain is also called the Top Cat virus. Theywere discovered in 1990 and 1991 in Ithaca, New York. The author of this virus,who also wrote the CDEF virus, was arrested shortly after it was discovered.



Its name comes from the fact that it uses an MDEF resource to reproduce. MDEFresources are normally found in certain applications, as well as the System file, sothe presence of this resource does not mean that a file is infected.

This virus attacks both applications and the System file, and can also infectdocuments and Desktop files. While it was not written to cause any intentionaldamage, it can be harmful. Some applications and other files may be damaged.

MDEF 666

See SevenDust.

MDEF 9806

See SevenDust.

MDEF 999

See SevenDust.

nVIR

The nVIR virus was first discovered in 1987 in Europe, and there are two mainstrains, nVIR A and nVIR B. This virus also is known under several other names,such as AIDS, Fuck, Hpat, Jude, MEV#, and nFlu.

This virus does not cause intentional damage, and reproduces by infecting theSystem file and applications. It will either beep, or, if MacinTalk is installed, have



the computer say "Don't panic". These events occur with varying probability whenthe computer is started up.

Scores

Scores, also known as the Eric, Vult, NASA and San Jose Flu virus, was first seen in1988 in the United States. Apparently, its author wrote this virus to study virusbehavior, but it quickly spread. It creates two invisible files, named Scores andDesktop_, infects the System file, and corrupts the NotePad and Scrapbook files, bychanging their icons. It then spreads to any other applications you run, but not allapplications can be infected by it. It can also cause random crashes and printingproblems.

SevenDust

There are several strains of the SevenDust virus, called A through G, and this virusis also known as MDEF 9806 and MDEF 666. These viruses spread through MDEF,MENU or WIND resources, and an extension. SevenDust E, also known asGraphics Accelerator, originated in a Trojan horse in 1998.

This family of viruses can infect applications, the System file, and control panels.They attempt to delete all files which are not applications on the startup volumewhen the computer is running between 6 and 7 am on the 6th and 12th day of anymonth.

The SevenDust F strain was spread through a Trojan horse calledExtensionConflict, and this strain has five sub-strains, that spread through otherextensions.



SysX

See INIT 9403.

T4

The T4 virus was first discovered in 1992. It was part of the game GoMoku,versions 2.0 and 2.1, which was uploaded to several ftp sites. It infects applicationsand the Finder, and attempts to alter the System file. It also masquerades as thefreeware antivirus program Disenfectant, in order to fool other antivirus programs.

It can cause irreparable damage to the System file, and cause random crashes. Itcan also prevent your computer from booting.

Another strain, T4-D, was found in 1997. This deletes files and documents in theSystem folder, but not the System file. It spreads from one application to another,by attaching itself to the application's CODE resource.

WDEF

The WDEF virus, first found in Belgium in 1989, gets its name from the WDEFresource found in the Desktop file. Its two strains, WDEF A and B, spread byinfecting these files, and, since the System reads the Desktop files of every disk itmounts, can spread very easily, without even needing applications to run.

It does not do any intentional damage, by some of its programming errors cancause problems, such as crashes, and font display problems.



ZUC

The ZUC virus was first found in 1990, and is named after its discoverer, DonErnesto Zucchini. There are three strains of this virus, ZUC A, B and C. They infectapplications only, and can spread even if the applications are not run. They causeerratic cursor behavior, but do no other damage.

user's manual - intego · intego virusbarrier x user's manual page 12 why you need to be...

Documents