Lost in Cyberspace
Mac Virus Alert
© 1998 by H.B. Koplowitz

One nice thing about owning a computer they don't write software for is that they don't write viruses for it either. Thousands of viruses have been created for Windows operating systems, while the only recent viruses to affect Macs have been cross-platform macro viruses spread by infected Microsoft Word or Excel files. Until now. 

AutoStart 9805 is the first new CTD (cyberly transmitted disease) to infect the Mac since 1994. Its most noticeable symptom is an odd whirring noise that ties up the hard drive on Macintosh PowerPC computers (including iMacs) every half hour. The virus is easy to cure and easy to prevent, but it's also easy to misdiagnose. And you never want to misdiagnose a computer virus. Take it from one who did.

I thought I was going nuts. Every half hour or so, it seemed, my computer would churn away and not let me do anything except sputter. After days of paranoia, I realized it was happening every 30 minutes exactly. Over time, my reaction to these half-hour "time outs" went from curiosity to irritation to anguish. Nobody I talked to had heard of the problem and nothing I tried helped. And I tried everything. Everything.

One of the first things I tried was a virus detector. But the most popular of the free virus detectors for Macs, Disinfectant, didn't detect anything. Nor did Disk First Aid or Norton Utilities. Defragging didn't help. Neither did fiddling with extensions, dumping preferences, uninstalling software, turning off the energy saver, purchasing a new clock battery and ultimately reinstalling my operating system. Twice. 

I finally gave up, since I was planning on buying a new computer anyway. But within a few days I was horrified to discover that my new computer had caught whatever it was. More fiddling with extensions, preferences and control panels were fruitless.

In desperation I tried the latest version of a commercial software application called "Virex" by Dr. Solomon's <www.drsolomon.com/home/home.cfm>, which detected something called AutoStart 9805 on my hard drive. Skeptical that I had at last found my problem, I typed AutoStart into a search engine and was directed to "MacInTouch" <www.macintouch.com>, which had a special report on something it called the AutoStart Worm.

According to the report, AutoStart is the first worm ever to attack the Mac platform. It was first detected in May, infecting the computers of desktop publishers in Hong Kong. A technical description of the virus didn't make much sense to me, until I came to a list of symptoms, one of which was "Extensive, unexplained disk activity every 30 minutes." Bingo.

A computer virus is a computer program that spreads by copying itself onto other computer programs. Created by disgruntled nerds and other miscreants, many viruses are pranks, perhaps causing a funny message to pop up on a certain date. Others wreak serious havoc, destroying files and erasing operating systems.

Most viruses attach themselves to ordinary program files, like the Word macro viruses. Worms, on the other hand, copy themselves onto the sectors of a disk, including floppies and Zip disks, which explains how AutoStart got from my old computer to my new one. Every 30 minutes it looks for an uninfected disk to corrupt, which also explains that damned whirring.

It turns out that preventing AutoStart is easy. According to a website called "MacVirus" <www.macvirus.com>, all you have to do is go to the QuickTime Settings control panel and uncheck the "Enable CD-ROM AutoPlay" box. (QuickTime 2.1 or earlier has no checkbox, so either disable it or upgrade to a later version.)

To practice safe computing you should also install an anti-viral program and keep it updated. Besides Virex, the other major commercial application for Macs is Symantec's Norton AntiVirus (formerly SAM) <www.symantec.com/us.index.html>. Both will automatically scan for viruses when you insert disks or download files.

Free anti-viral programs that claim to cure the AutoStart worm include Innoculator by MacOffice <www.macoffice.com/innoculator.htm>. However, Disinfectant is no longer being updated, and is not effective on AutoStart or Word macro viruses. 

The two main ways computers catch viruses is through infected diskettes and infected files, such as an attachment to an email. That is why you should beware of files attached to unsolicited emails. But your computer cannot catch a virus just by downloading and opening an email unless you also open the infected file.

One more thing you should do if your computer catches a CTD is have the decency to tell those you may have practiced unsafe computing with. If you don't know how to break the bad news, send them this column. Remember, with CTDs as STDs, what goes around comes around.
 

copyright 1998 By H.B. Koplowitz, all rights reserved.