AutoStart 9805 virus-Any Background Info?

[Joel Abrams]

This AutoStart 9805 virus ended up on my mac at home, at work at a commercial radio station on our mac we use for Pro Tools and at my other job on a variety of macs at a college where I teach radio & production.

The computer will pause for 15 to 25 seconds, then return to normal function. Norton Anti Virus detects it and repairs it.

As I pass floppys between all these computers, I know I spread it to all the computers I know & love.

Does anyone know its source? Or has anyone encoutered it & have relatable experience?
-Thanx, Joel

[coaster]

you need a worm scanner. do an internet search for 'autostart'. watch out for your keys...
also, turn off atouplay in QT if you haven't.
i think the virus is installed off the system cdrom, but apple wouldn't release buggy software would they?

[Joel Abrams]

Thanks for the info! The web search proved fruitful. It IS a worm, from Hong Kong spread in the states thru the .edu community. Not from mac OS.

[BTECH]

Well your post is very interesting.

I configured 3 ProTools 5 Sytems last week & watched to my horror progressive degeneration of 2 of them due to this same virus which we found at 2am after a prayer meeting! Where did it come from? Well they were brand new G4 sawtooth machines & brand new disks/CD's. No other disks or CD's were used. I found it on 1 key disk - but on another 2 key disks found MBDF B virus. This virus was resident with the Autostart 9805 one. I would love to know if the worm promotes this other virus?? I found it extremely agressive actually damaging system files.

Thankyou Virex !!

Love to know where it came from too.....

[Joel Abrams]

Chris-Which Key disc(s).-Joel

[batman]

Hi all

There have been several of these autostart viruses, rampant in the last coupla years..
About one year ago a particular virulent strain hit the UK and had various effects, from wiping out the entire office server/database for a company "which shall not be named" to interfering with my accessing ManchesterUnited FC.com.
It resides in the "Desktop Printer Spooler", so you will have to boot up from the Norton Antivirus5 CD and delete that file ( and , of course, any other infected writable media)

All the best

Ade