|Place of Origin|
|File Type(s)||Mac Desktop files|
|Infection Length||1,836 bytes|
Wdef was an extremely widespread virus for the Macintosh in 1989 and 1990. It was the first virus for the Macintosh system to not use executable files, opening the door to similar Macintosh viruses of the early 1990's such as Mdef and Cdef.
Wdef infects Desktop files. It is introduced to a system when removable media containing the virus is attached to the system. The virus is triggered when the Desktop file is executed, which is usually when the media is inserted. It adds a 1,836 byte resource to the Desktop files on all connected volumes.
A likely unintentional side-effect Mdef is that it may cause window updates to be delayed, and it will cause the system to hang when a window is opened or closed. The virus contains a bug that causes it to crash on the Macintosh models Mac IIcis and Mac IIcxs.
The virus may have been very widespread by the time it was discovered. It was already in the US and Belgium at the time of its discovery. It was particularly prominent at universities, though it may have been everywhere. Educational institutions were the only places at the time that were certain to be connected to the Internet to report it, while for home users Internet connection was rare in the late 1980's and early 1990's.
Shortly after its discovery, it was found on several computers at the University of Georgia. It was also found at the University of Kentucky. SUNY Binghamton reported an infection that spread rapidly possibly originating from a pair of printing stations recently brought to the university. The University of Vermont reported an infection possibly originating from a student from Dartmouth. Nearly every Macintosh of the labs at the University of Southern California was infected. It even made an appearence at Lehigh, home of an earlier ground-breaking virus, where it infected five computers. In 1990, it spread to colleges and universities in almost every US State and several countries around the world.
Wdef was also found a few times pre-installed on commercial software. It first showed up on commercial software in January of 1990, in a program known as "Grammitik" and a MacPublishing fon disk. In April of the same year, it was found on the games Chessmate 2100 and Cribgin and a diskette distributed by the Institute for Scientific Information. In May, the Macintosh-themed magazine Diskworld released a diskette with the virus on it. Microsoft sent the virus in June with Excel. It was found in Rodime PLUS/RX utilities in February of the next year. As late as September of 1994, it was found on a CD released by MacFormat, a UK magazine.
By the time it was discovered, it was already in Belgium, Northwestern University (Chicago, Illinois, USA) and the University of Texas. Given the unique nature of the virus, it is possible that it spread as far as these places before being discovered. Its origin is uncertain.
Ronald Greinke. Virus Test Center, University Hamburg, WDEF Virus.
Attrition.org, Vendor FAIL - Certified Pre-Owned (CPO). 2008-2011
- Pete Troxell. "WDEF Virus Alert." 1989.12.07
- Frank Steele. "WDEF." 1989.12.09
- ACSAZ@SEMASSU.BITNET. "Wdef at UKCC." 1989.12.11
- firstname.lastname@example.org. "WDEF found at SUNY-Binghamton." 1989.12.14
- Lynne Meeks. "WDEF found at University of Vermont." 1989.12.14
- Greg Ford. WDEF virus..... 1989.12.19
- Carl_A.Fassbender. Gatekeeper and Gatekeeper Aid. 1989.12.19
- Rich Silvius. WDEF virus infects Lehigh. 1989.12.22
- Andrew Salamon. WDEF A. 1990.01.10
- Joe Simpson. WDEF virus (Mac) in southwestern Ohio. 1990.01.12
- Colman Reilly. WDEF in Ireland. 1990.01.16