ANTI

ANTI is a computer virus affecting Apple Macintosh computers running classic Mac OS versions up to System 6. It was the first Macintosh virus not to create additional resources within infected files; instead, it patches existing CODE resources. The most commonly encountered strains of ANTI have only subtle effects, and thus can exist and spread indefinitely without being noticed until an antivirus application is run. Due to a bug in the virus, it cannot spread if MultiFinder is running, which prevents it from infecting System 7 and later versions of Mac OS as well as System 5 and 6 running MultiFinder. Mode of operation ANTI only infects applications (as opposed to system files), and therefore can only spread when an infected application is run. When such an application calls the OpenResFile function, the virus searches the computer for applications that fulfill all of the following criteria: They have CODE (application code segment) resources with resource IDs 0 and 1 CODE 1 begins with a JSR instruction (generally the Main resource in a given application) The application is not already infected with ANTI The sum of the size of CODE 1 plus the size of the virus is less than or equal to 32,768 bytes All matching applications are then infected by appending the virus to the CODE 1 resource and adding a corresponding entry to the application's jump table. Variants There are three strains of ANTI, with the following differences: ANTI-A: 1,344 bytes plus 8 byte jump table entry. The first version to be isolated, in France in February 1989. Searches for ANTI-B strains and converts them into ANTI-Variant. ANTI-B: 1,144 bytes plus 8 byte jump table entry. Discovered in France in September 1990. Despite the later discovery date, it is believed to be the earliest version of the virus. Also known as ANTI-0. ANTI-Variant: Discovered in September 1990. The result of ANTI-A finding and modifying an ANTI-B strain. Causes the computer to hang when the infected application is run. Also known as ANTI-ANGE.