# NVIR

> Mediated Wiki article. Canonical URL: https://mediated.wiki/source/NVIR
> Markdown URL: https://mediated.wiki/source/NVIR.md
> Source: https://en.wikipedia.org/wiki/NVIR
> Source revision: 1353623467
> License: Creative Commons Attribution-ShareAlike 4.0 International (https://creativecommons.org/licenses/by-sa/4.0/)

Computer virus

nVIR Malware details Technical name Mac OS/nVIR virus Aliases AIDS, Fuck, Hpat, Jude, nVIR, MEV#, MODM, nCAM, nFLU, kOOL, SHIT, prod, PISS Type Macintosh Subtype Application infector. Nuisance; system hanger. Classification Virus Family nVIR, three predominant strains: nVIR-A, nVIR-B, nVIR-C Isolation date 1987 (nVIR-A and nVIR-B), 1991 (nVIR-C) Origin Unknown Author Unknown

**nVIR** is an obsolete [computer virus](/source/Computer_virus) which can replicate on Macintosh computers running any System version from 4.1 to OS 8. The [source code](/source/Source_code) to the original nVIR has been made widely available, and so numerous variants have arisen. Each variant causes somewhat different symptoms, such as: application crashes, printing errors on laser printers, slow system response time, or unpredictable system crashes. nVIR spreads through any nVIR-infected program, but due to the long period of time nVIR lies basically dormant in a host system, nVIR generally finds its way into system backups and is not detected until the first overt symptoms appear. For example, if a disk used in an infected Macintosh is removed and inserted in a second Macintosh, the other machine will become infected if any application on that disk is executed in the second machine. Further, any method used to transfer programs between Macintoshes will spread nVIR, including [file transfer](/source/File_transfer) over a network. However, nVIR cannot spread via a print network's hardware.[1]

nVIR carries an additional code resource, CODE 256 (though some variants carry CODE 255), and patches the [jump table](/source/Jump_table) to point to it. The original application's entry point is saved in the nVIR 2 resource. nVIR introduces to the System file the INIT 32 resource which is executed at startup, at which time nVIR patches the TEInit trap. Any application subsequently calling this trap will be infected. The nVIR 3 (or nVIR 5) resource is a copy of INIT 32. An nVIR 10 resource in the System file will prevent nVIR infection. If an application calls OpenResFile prior to TEInit, that application will be damaged.

nVIR 0 resource holds a counter that is set to 1000 on the first infection of the system. Each reboot decrements the counter by 1. Each application launch decrements it by 2. When the counter reaches 0, nVIR will beep 1 out of 8 reboots and 1 of 4 infected application launches. If [MacinTalk](/source/MacinTalk) is installed in the machine's [System folder](/source/System_folder), the machine may occasionally say "Don't Panic". Otherwise, it may beep unexpectedly.

nVIR has been known to 'hybridize' with different variants of nVIR on the same machine.

## References

1. **[^](#cite_ref-1)** Scanlin, Mike. ["A Vaccine for the 'nVIR' Virus"](https://web.archive.org/web/20070313094856/http://www.mactech.com/articles/mactech/Vol.04/04.05/Virus/). *MacTech*. Archived from [the original](http://www.mactech.com/articles/mactech/Vol.04/04.05/Virus/) on March 13, 2007.

## External links

- [Mac OS/nVIR virus](https://web.archive.org/web/20030102235308/http://vil.nai.com/vil/content/v_99830.htm), by McAfee

- [nVIR A](https://web.archive.org/web/20200423201946/http://agn-www.informatik.uni-hamburg.de/catalog/mac/html/nvira.htm), by Virus-Test-Center, University of Hamburg

- [nVIR B](https://web.archive.org/web/20200423201944/http://agn-www.informatik.uni-hamburg.de/catalog/mac/html/nvirb.htm), by Virus-Test-Center, University of Hamburg

- [nVIR C](https://web.archive.org/web/20200423201944/http://agn-www.informatik.uni-hamburg.de/catalog/mac/html/nvirc.htm), by Virus-Test-Center, University of Hamburg

- [nVIR B countermeasures](https://web.archive.org/web/20070610001737/http://istpub.berkeley.edu:4201/bcc/Summer95/mic.macvirus.html), UC Berkeley

v t e Hacking in the 1980s ← 1970s Timeline of security hacking incidents Timeline of computer viruses and worms 1990s → Individuals Daniel Sentinelli Fernando Bonsembiante Justin Tanner Petersen Kevin Mitnick Lewis De Payne Lenny DiCicco Markus Hess Hans Heinrich Hübner Pablo Kleinman Raúl Barragán Susan Headley Groups The 414s Piratas Unidos Argentinos Malware 4K AIDS Trojan horse AIDS virus Alabama ANTI Brain Byte Bandit Cascade Christmas Tree EXEC CyberAIDS EGABTR Elk Cloner Father Christmas Festering Hate Ghostball HyperCard viruses Jerusalem Lamer Exterminator MacMag Morris nVIR Ping-Pong SCA Scores Stoned Virdem WANK

---
Adapted from the Wikipedia article [NVIR](https://en.wikipedia.org/wiki/NVIR) by Wikipedia contributors ([contributor history](https://en.wikipedia.org/wiki/NVIR?action=history)). Available under [Creative Commons Attribution-ShareAlike 4.0 International](https://creativecommons.org/licenses/by-sa/4.0/). Changes may have been made.