This page is a wiki. Please login or create an account to begin editing.


MacAddict CD-ROMs

Game screenshot
Rating:
Your rating: None Average: 5 (3 votes)
Category:
Year released:
Author:
Publisher:
#1
[www].se [ftp].se [mirror].us
macaddict_125cds.sit (1.82 MB)
For System 7.0 - 7.6 - Mac OS X
#2
[www].se [ftp].se [mirror].us
MacAddict28_clean.toast_.sit (597.47 MB)
For System 7.0 - 7.6 - Mac OS X
Emulation
Guides on emulating older applications
MacAddict CD-ROMs at the Internet Archive
The archived collection is available for download
with 125 cover discs starting from disc 01

The first file downloadable directly from this page is a DiskTracker catalog taken from the final issue, including the contents of all 125 MacAddict CDs.

The second download is a clean copy of MacAddict disc #28 which was originally released containing the autostart worm. The copy on the Internet Archive contains the worm.

Read more about this magazine at: http://en.wikipedia.org/wiki/MacAddict

Compatibility
Architecture: 68k PPC

Comments

SkyCapt's picture
by SkyCapt - 2017, October 30 - 6:40pm

Cd-ROM Autoplay feature, I see now that's what's meant by "AutoStart", this is the preferred method of initial infection. Since I used disk images in Disk Copy (OS9) and Disk Utility (OSX) then I didn't get the autostart, but if I had burned disc #28 to CD or probably mounted it using Virtual CD (OS9) then it will auto execute the APPL'ications in CD root and self infect. The main thing is the clock date, 9805-D kills itself after Xmas 1998.

The extension filename used by 9805-D is "DELDesktop Print Spooler" (hidden) and its refresh timer is always exactly 10 minutes. 9805-D is really a modified version of the DB virus which it attacks, in the same kind of wrapper, which tries very hard to appear inocuous. The DB virus uses a hidden extension named "Desktop Print Spooler", and DELDB erases that file too. DELDB really tries to be 'superhero' by attacking more than one virus. There was a mutation of the DB virus which simply changed the filename it uses to become "BD" not "DB", and so... DELDB erases "BD" root files also. It may even try to erase more names, I just don't know... and yes scrambling the Type Code is its final suicide of its last copy. OS9 can do it, it matters which copy is "in use" - the codes on the Extension file are what got scrambled when it appeared to leave an app unscrambled.

MikeTomTom's picture
by MikeTomTom - 2017, October 30 - 9:33am

Disc 28's malware 9805-D (file named "DELDB") has an expiry date being Christmas Eve 1998.

Very interesting detective work there, SkyCapt. Thank you for all of that info. Excellent stuff. Also interesting, the last mod date of the CD-ROM is Oct 01, 1998 and DELDB is invisible (hidden). So it's even less than activate-able, which is good to know. I'm going to have to check for hidden extension files with "Print" in the middle of their names now Tongue

Do you have "Enable CD-ROM Autoplay" set in your QuickTime Control Panel in 9.2? You had mentioned not being able to have this thing auto-start before your last edits. I was just wondering if this could be why (it didn't auto-launch).

I do find it interesting to learn that it's an anti-virus, virus Wink

SkyCapt's picture
by SkyCapt - 2017, October 30 - 7:11am

I learned more. Disc 28's malware 9805-D (file named "DELDB") has an expiry date being Christmas Eve 1998. To start an infection, I tested the app "DELDB" requires i execute it with the system clock date set way back. There had been harmful viruses in files named "DB" so this program's chosen name DELDB descibes what it does, it attacks and deletes the "DB" viruses - confirmed, if I make a file named DB in a volume root directory, DB gets erased. When the system clock date crosses out of Dec 24 1998, then DELDB shifts from its own spread mode into deleting itself. Since it can't delete the last copy, it makes that last file become a Hidden file (if not already). In OSX Classic Environment it also scrambles its own Creator and Type codes, but in OS9.2 it does not scramble them. I don't know why that difference is, seems like code scrambling is one extra means that it uses to disable itself but that little effort fails OS9.

AV documentation states these viruses create a hidden extension file (with "Print" in the middle of its filename), which is how they autostart after rebooting. Even then, the DB/DELDB viruses don't make new copies of themselves immediately after rebooting nor upon seeing a new volume mounted. Instead, they use a timer which waits from intervals of 3 to 30 minutes before trying to put the virus on all attached volumes.

Yes maybe Virex doesn't look "too hard" for 9805-D ("DELDB"), given its accepted Low/Minimal threat assessment...

MikeTomTom's picture
by MikeTomTom - 2017, October 30 - 1:52am

The 9805-D virus comes with Creator Code "????" and Type Code "APPL" (application). When launched (yes I play infected myself, great fun) the first thing it does is change its own codes to garbage, even if run in the Classic Environment of OSX. Then it turns out Virex no longer detects it when its Type Code isn't "APPL"! How messed up is that? Change a superficial file system flag and no longer caught by Virex anti-virus. Change its code back yourself to APPL and then Virex tells you its a virus! Ay caramba!

Tho' in the classic OS, how could it run again after a reboot of the system when it's no longer recognized as being executable? If as you say it is a Superhero "good" virus... combating other viruses... after checking & clearing the OS it disables itself by removing the APPL Type. This is probably all it does and it won't be able to run again. Virex certainly is capable of detecting viruses injected into standard Mac executable files so maybe it see's this as being unable to run and ignores it. Interesting tho', thanks for the info.

SkyCapt's picture
by SkyCapt - 2017, October 30 - 1:05am

Malware on disc 28 is not a member of the sevendust grouping, and they say it ("Autostart 9805-D") causes no damage which is why it's given a "Low" threat assessment. While other variants in the Autostart group do harm to systems, the D (and C) varieties are wry viruses that fight other viruses, how strange. The D is even so polite as to delete itself after having won its war (it's still a virus and still malware because it's technically unable to delete the very last copy of itself). Superhero "good" viruses... combating other viruses... I never imagined this.

The 9805-D virus comes with Creator Code "????" and Type Code "APPL" (application). When launched (yes I play infected myself, great fun) the first thing it does is change its own codes to garbage, even if run in the Classic Environment of OSX. Then it turns out Virex no longer detects it when its Type Code isn't "APPL"! How messed up is that? Change a superficial file system flag and no longer caught by Virex anti-virus. Change its code back yourself to APPL and then Virex tells you its a virus! Ay caramba!

mrdav's picture
by mrdav - 2017, October 28 - 2:07am

Thanks very much for the offer MTT, but it is OK as I already have a clean copy with date stamps intact ready to upload. I will do it today.

EDIT: Done

MikeTomTom's picture
by MikeTomTom - 2017, October 28 - 12:20am

Thanks for the notice, mrdav. I can upload a clean copy of #28 to this page, if you'd like (with original date/time stamps intact). Either way, no worries.

mrdav's picture
by mrdav - 2017, October 27 - 7:37am

The only MacAddict original disc that I know of that has been reported with malware (the autostart worm in this case) is #28. I will be uploading a clean version in the next day or so (but I will check the version on the Internet Archive first to see if it is a clean copy). I believe MacAddict might have reissued #28 but I cannot confirm this.

EDIT: The Internet Archive copy IS infected with the worm. I will proceed with a clean upload here.

MikeTomTom's picture
by MikeTomTom - 2017, October 27 - 3:29am

Hi Scott, OK thanks.

scott Praed's picture
by scott Praed - 2017, October 27 - 3:09am

MikeTomTom I download mac addict 60/ aug 2001. I found no 666-A Virus. Maybe disc original has virus but on website they clean the disc and upload back on. That why no 666-A virus. The original disc need to be check for the 666-A virus. I don't have the original disc but I did but I throw all away.

MikeTomTom's picture
by MikeTomTom - 2017, October 27 - 2:25am

elf Forest 2.5 shareware is on disc called mac addict 60/ aug 2001 is in fun and games folder. That game has 666-A virus.

Hi Scott, thanks for the alert. I am not able to detect 666-A in this game, using Virex with 2007 defs. Not in the MacAddict installer for it, nor in the game once installed. Nor can I see it's 666 resources in the game's resource-fork when it is dragged onto ResEdit (where 666-A is usually visible if present). It and this CD comes up clean for me.

Perhaps someone else from here can also take a look at this MA 60 Cover Disk and compare, for a 2nd opinion. It requires downloading from this Web Archive page if you don't have a copy.

scott Praed's picture
by scott Praed - 2017, October 27 - 12:50am

The elf Forest 2.5 shareware is on disc called mac addict 60/ aug 2001 is in fun and games folder. That game has 666-A virus. I recommend you scan this disc and clean this disc. That is carbon game.

MCP's picture
by MCP - 2011, March 13 - 2:59am

It's okay, there's always a learning curve with this stuff. You'd think it would be easy enough but it never is.

SAHunterMech's picture
by SAHunterMech - 2011, March 12 - 8:55pm

Okay, update from my end.

In Mac OS 10.5.8, I downloaded the 3 segments from Safari.
Following MCP's advice, I put the 3 segments in their own folder (by themselves for good measure). I dragged the first segment on top of Stuffit (the application, not the window that says "drag your files here".)

If it helps, I went to the Login window while the process went down.

To my shock, Stuffit started expanding the 3 files into 1 disk image. It even finished the process completely and didn't hang. However, upon double clicking the .dmg, Mac OS X still says the image could be damaged.

Again, if it helps, the .dmg is now locked, while before, it was not.

Upon mounting it in sheepshaver, however, despite the fact that Mac OS X said the disk image was damaged, it ran fine. Nostalgia ran abounds. I was playing "Gone Fishin'" in a heartbeat.

All I can say is, thank you very, very much. In my defense, I didn't mean to make my comment sound like a complaint. I'm just.. mentally challenged sometimes. Since I was created, I've unfortunately only grown about 10 times smarter since then.

bertyboy's picture
by bertyboy - 2011, March 12 - 4:30pm

Could be prefs, although the default setting is to work exactly as MCP described.

Open Preferences in Stuffit Expander, v7 is fine. There's a Joining tab, select that and then there's a checkbox for "Join Segmented Files", make sure it's checked. There's also an "Expand Joined File (if possible)" checkbox, it should be checked also.

Otherwise tell us exactly what you do to download these, ie. OS, browser, and how you try to join and expand them.

MCP's picture
by MCP - 2011, March 12 - 1:18pm

I've tested my archives with several versions of Stuffit Expander 5.5 and later, on both mac and pc, without problems. I don't know what you're doing wrong but dozens of people have downloaded those archives without a complaint. The most common thing people do wrong at first though is to double-click the archives or right-click and "open." It's much better to drag-and-drop onto Expander.

SAHunterMech's picture
by SAHunterMech - 2011, March 11 - 10:44pm

Which version of Stuffit are you using? I've used 7.0 and the latest version, and both refuse to recognize the .1/ .2/ .3 segments.

MCP's picture
by MCP - 2011, March 8 - 4:00am

Put the segments in the same directory, and drag-and-drop the first one onto StuffIt Expander, on PC or Mac.

SAHunterMech's picture
by SAHunterMech - 2011, March 7 - 8:41pm

I have something of an issue here.

After downloading the 3-part .sit file, which I managed to concatenate with a program called MacHacha (the only one that could deal with ".1" as opposed to ".001"), I then opened the .sit in Stuffit.

Stuffit (in OS X) manages to expand the file - - - almost. It gets stuck at the last 1/20th of the progress bar, and never finishes. After force quitting Stuffit, the disk image, while labelled as damaged by the system, opens well enough. However, after mounting it in SheepShaver (running OS 9) I noticed that the disk had trouble launching certain files, as well as the interactive "Start Here" program.

The same issue happened with MacAddict 002, only this time more of the individual files, demos, and the like would not open.

Are the downloadable sit files corrupt, or has MacHacha concatenated them incorrectly?

MCP's picture
by MCP - 2011, March 4 - 4:53pm

I've currently uploaded everything up to #29. I own every disc up to 72, and a few more after that. A full list of which discs I will be able to upload are on the Old Mac Archive's "Wish List" page.