Wdef
Wdef
Type File virus
Creator
Date Discovered 1989.12.15
Place of Origin
Source Language
Platform MacOS
File Type(s) Mac Desktop files
Infection Length 1,836 bytes
Reported Costs

Wdef was an extremely widespread virus for the Macintosh in 1989 and 1990. It was the first virus for the Macintosh system to not use executable files, opening the door to similar Macintosh viruses of the early 1990's such as Mdef and Cdef.

Behavior

Wdef infects Desktop files. It is introduced to a system when removable media containing the virus is attached to the system. The virus is triggered when the Desktop file is executed, which is usually when the media is inserted. It adds a 1,836 byte resource to the Desktop files on all connected volumes.

A likely unintentional side-effect Mdef is that it may cause window updates to be delayed, and it will cause the system to hang when a window is opened or closed. The virus contains a bug that causes it to crash on the Macintosh models Mac IIcis and Mac IIcxs.

Effects

The virus may have been very widespread by the time it was discovered. It was already in the US and Belgium at the time of its discovery. It was particularly prominent at universities, though it may have been everywhere. Educational institutions were the only places at the time that were certain to be connected to the Internet to report it, while for home users Internet connection was rare in the late 1980's and early 1990's.

Shortly after its discovery, it was found on several computers at the University of Georgia. It was also found at the University of Kentucky. SUNY Binghamton reported an infection that spread rapidly possibly originating from a pair of printing stations recently brought to the university. The University of Vermont reported an infection possibly originating from a student from Dartmouth. Nearly every Macintosh of the labs at the University of Southern California was infected. It even made an appearence at Lehigh, home of an earlier ground-breaking virus, where it infected five computers. In 1990, it spread to colleges and universities in almost every US State and several countries around the world.

Wdef was also found a few times pre-installed on commercial software. It first showed up on commercial software in January of 1990, in a program known as "Grammitik" and a MacPublishing fon disk. In April of the same year, it was found on the games Chessmate 2100 and Cribgin and a diskette distributed by the Institute for Scientific Information. In May, the Macintosh-themed magazine Diskworld released a diskette with the virus on it. Microsoft sent the virus in June with Excel. It was found in Rodime PLUS/RX utilities in February of the next year. As late as September of 1994, it was found on a CD released by MacFormat, a UK magazine.

Origin

By the time it was discovered, it was already in Belgium, Northwestern University (Chicago, Illinois, USA) and the University of Texas. Given the unique nature of the virus, it is possible that it spread as far as these places before being discovered. Its origin is uncertain.

Sources

Ronald Greinke. Virus Test Center, University Hamburg, WDEF Virus.

CIAC, Viral Infections in Commercial/Government Media/Software. 1996.09

Attrition.org, Vendor FAIL - Certified Pre-Owned (CPO). 2008-2011

Virus-L Digest

19891989_virusfile_virusfirstmacintoshmacintosh_virusmacosmacos_viruspreinstalledvirus
Unless otherwise stated, the content of this page is licensed under Creative Commons Attribution-NonCommercial-ShareAlike 3.0 License