The Code 9811 Virus

It was after more than three years of almost daily use of my Macintosh® computer, and it was after having downloaded about one to ten files from the Internet on every of these days, I suddenly got severely infected by a computer virus:

The days before my computer had started behaving strangely: I got “Out of memory” error messages as I wanted to start applications. I saw the desktop utility The Tilery showing my applications with strange names like DPEVLZREEYO or BMQTKECNLI. Incidentally, using the Apple® program ResEdit, I found an invisible copy of a program in its folder with a strange name as the above. I found it a bit peculiar, but didn’t think that much more about it.

I did all the things I had learnt when having problems with a Macintosh computer: I rebuilt the desktop. I started up without any extensions. I zapped the PRAM. The problem didn’t go away. Then I reformatted the hard disk, and reinstalled all my software.

The problem was still there: “Out of memory” as trying to launch some applications, and then this different sound my Mac was making: It sounded as the machine was occupied with something all the time. It was a very quiet rhythmic sound.

Finally I thought I must have a hardware problem. Could it be a loose contact? I opened my computer and tried to find something being loose, but couldn’t. I was getting worried I would have to buy a new machine.

The next day, a monday morning mid December 1998 before going to my work, a computer virus unmasked its presence: All of a sudden my desktop turned all white, then a lot of black worms with yellow heads came crawling in from my screen’s borders, like eating the desktop. Then a message: “You have been hacked by the Praetorians”. At the end of this “show” a red Pi-sign was built in the middle of the screen, with the heads of the worms like yellow virus-like balls bumping towards its inner borders.

I was very happy and relieved. I was having a software problem. I wouldn’t have to buy me a new computer!

Reporting my findings to Susan Lesch at Mac Virus Com I learnt that this Macintosh virus is known as the Code 9811 Virus. It was reported to Symantec® in November 1998 by the Swede Tommy Sandström. Symantec included a fix for it in their December 1998 virus definitions for the Symantec AntiVirus and Norton AntiVirus® programs.

The Code 9811 Virus “end of show”. Screenshot by Tommy Sandström (email no longer active)

Having downloaded a trial version of Norton AntiVirus® and used it to scan old DropStuff-compressed backups of my entire internal hard disk, I have been able to find copies of the Code 9811 Virus from as early as the seventh of August 1998. As I wrote above it wasn’t until mid December 1998, five months later, I realized I was having the virus infection. This indicates that the virus replicates very slow for a long time and then suddenly appears executing its full effects.

The Code 9811 Virus infects on both 68K and PPC Macs running the Classic Mac OS.

Anyone who starts getting strange messages as trying to start applications running the Classic Mac OS should suspect the Code 9811 Virus.

Web pages on the Code 9811 Virus

• John William Dalgliesh has made a very careful examination of the Code 9811 Virus. (Historical link — site no longer updated.)
• Symantec antivirus research center — link no longer active; Symantec was acquired by Broadcom.

Anti virus software that detected the Code 9811 virus

Agax is a freeware program made by John William Dalgliesh that among other viruses detects the Code 9811 Virus. For some time it seemed that users of the Classic Mac OS would be quite safe against Macintosh computer viruses using the combination of Agax and Disinfectant (also a freeware program). Neither Disinfectant, made by John Norstad, nor Agax are kept updated. Classic Mac OS is no longer safe to use, especially if connected to the Internet. (Agax site no longer updated; Disinfectant download link no longer active.)

Norton AntiVirus® is a commercial program, which since 1998 detected and removed the Code 9811 Virus, even in compressed archives. Norton AntiVirus for the Classic Mac OS has been discontinued. (Original product link no longer active.)

McAfee® Virex®, a commercial anti virus program, from its February 2001 Virus Definitions also detected the Code 9811 Virus — both in compressed and uncompressed archives. Virex has been discontinued. (Original product link no longer active; Network Associates was later renamed McAfee.)