Thread

Old Mac Viruses?

68kMLA Troubleshooting 19 posts Aug 19, 2015 to Oct 24, 2015

#1 Wed, 19 Aug 2015 - 18:13 68kMLA

I am researching old (pre-OS X) Mac viruses, the older the better. I've found references to quite a few historic documents that speak about their methods of infection (INIT hooks and such) and their triggers but I would like to be able to find actual copies of some of them for analysis. Does anyone know of a source where some of this old malware is archived/exists?

If you do have sources please reply to me via private message.

Feel free to share your experiences with old infections and include the names if you remember them. Thanks!

#2 Wed, 19 Aug 2015 - 18:54 68kMLA

Had you asked me 15 years ago I could have helped.

Speaking of which, my brother wrote a "virus" in AppleScript. It's loaded on one of the secretary's computers (at behest of the other secretaries as the longest running April Fool's Joke.) He hates the Chipmunks, so every Christmas it plays Chipmunks Christmas songs. You can't mute it or anything. It's been like that for past 3 years.

#3 Wed, 19 Aug 2015 - 21:53 68kMLA

I actually did find an archive of old viruses somewhere, but I can't seem to find it now...

#4 Wed, 19 Aug 2015 - 22:04 68kMLA

Found the archive - PM sent.

#5 Thu, 20 Aug 2015 - 03:01 68kMLA

Thanks onlyonemac! You are awesome.

I am still looking for additional old viruses if anyone knows of additional sources.

#6 Thu, 20 Aug 2015 - 22:44 68kMLA

Darn. I check the Internet Archive, and none of the original 1990s l0pht.org sites were archived. Not surprising since it only allowed a maximum of 4 HTTP connections. I remember siting on the website clicking the refresh for hours until I got a connection, then it was attempting to download anything and everything as fast as you could (well, as fast as a 2400 baud modem would let you.)

#7 Fri, 21 Aug 2015 - 13:21 68kMLA

I might have a couple on my server, I'll check after work and send them your way if i find any

Edit, Just checked, Nothing (Seems they never made it onto my server, i'm sure I downloaded them though...) I might still be able to get hold of a couple, I'll let you know if I have any success.

#8 Sat, 22 Aug 2015 - 02:25 68kMLA

I had a huge horde of PC viruses, and some Mac viruses on a floppy disk, each time I would run into a virus back in the day, I kept a copy. Sadly the disk went bad

#9 Sun, 23 Aug 2015 - 00:04 68kMLA

hey O1M could you send me that link too? not that i have time or anything, but would like to check it out if i ever get free time.

#10 Tue, 25 Aug 2015 - 14:57 68kMLA

Don't know why we can't just post the link here, but PM sent anyway. Also, it's OOM, not O1M.

#11 Tue, 25 Aug 2015 - 18:33 68kMLA

You *should* be fine to post links here now, cory has softened his stance on software links.

#12 Wed, 26 Aug 2015 - 00:24 68kMLA

Well, if you link to viruses, theoretically Google could peg the forum as unsafe.

#13 Wed, 26 Aug 2015 - 19:02 68kMLA

That's true, I didn't think of that.....

#14 Thu, 27 Aug 2015 - 14:49 68kMLA

I don't think Google would care about vintage Mac virsues, they MIGHT be a legal problem though, I don't know.

#15 Fri, 28 Aug 2015 - 01:46 68kMLA

Well, its not that "google" case per-say, the problem is the automated AV engines. if those old viruses are still in their databases, itll detect it and flag it.

#16 Fri, 28 Aug 2015 - 06:34 68kMLA

I believe (this) [ Everything Else » Software ] forum is not readable by public, so hyperlinks are not a risk.

#17 Fri, 28 Aug 2015 - 06:56 68kMLA

butterburger said:
I believe (this) [ Everything Else » Software ] forum is not readable by public, so hyperlinks are not a risk.

Are you sure? My understanding is that only the Lounge is private.

c

#18 Fri, 28 Aug 2015 - 21:59 68kMLA

I can confirm that it is only the Lounge (and perhaps one or two other forums from the "Community Collections" category) that is private. I have browsed this part of the forum many times as a guest.

Also as far as I know, a surprising amount of antivirus programs still detect old Macintosh viruses. Obviously I'm not sure what algorithm Google use, but if it's anything fairly mainstream it will probably detect the viruses. Furthermore, the site containing the viruses hosts a number of more modern (and PC) viruses as well, so Google might well just detect the link to that site, and find fault with the 68kmla simply because it links to a site that hosts viruses (although I'm not sure whether or not they do that). Also I seem to think that I found that site itself with a Google search (or at least re-found it like that) but I can't remember for sure.

#19 Sat, 24 Oct 2015 - 06:34 68kMLA

I'm still not really comfortable with the idea of such a site being linked too so brazenly in the open for reasons that really require no explanation... sure, *most* of us probably dont hit he web with classic a whole lot (i am an exception and i sure there are others), and the risk of said caches of malware being actively sought by a rogue just to cause trouble are probably minimal these days, however nonetheless it is still a risk factor, no matter how small... We really shouldnt b doing anything that makes such materials more accessible than Google already does, SO I am all for kepping these sorts of links in PM's rather than the open forum.