MBDF-b virus — description and removal.

Here is a brief description of the virus and what it can and cannot do to your system. The MBDF-b virus resides in the resource fork of an application — in this case, only in the 68000 component of the Session software, not the PowerPC component — and becomes active when that application is launched. The virus can replicate by incorporating itself into the resource fork of the active System file. Once there it can add itself to other running applications, or even idle applications whose resource forks are opened by running applications. Since the virus lives in the resource fork of the 68000 component of Session software and is only activated when the code resources are being used, the virus cannot directly infect a PowerMac. However, a PowerMac can get infected by an infected, non-native application (i.e. an application running in PowerPC emulation mode), but this is not the case with Session’s fat binary design.Once it’s in the System file, MBDF-b continuously tries to infect active applications. In some cases it could cause an application to crash or behave strangely. We have observed a case where disk-swapping difficulties associated with the Session installer were eliminated once the system was disinfected. One explanation for this is that the virus was trying to continuously reference the installer application which resides solely on the first disk in the set, and created an endless disk-swapping situation.To remove the virus from your system, first deauthorize the currently installed version of Session software. Then run the Disinfectant utility program to remove any viruses from your Macintosh.

Knowledge Base