Welcome to the MacNN Forums.

If this is your first visit, be sure to check out the FAQ by clicking the link above. You may have to register before you can post: click the register link above to proceed. To start viewing messages, select the forum that you want to visit from the selection below.

You are here: MacNN Forums > Enthusiast Zone > Classic Macs and Mac OS > 666 extension...Possessed system?

666 extension...Possessed system?
Thread Tools
Dedicated MacNNer
Join Date: Jul 2001
Location: Trapped in Amber
Status: Offline
Reply With Quote
Aug 17, 2001, 10:22 AM
Anyone ever seen an extension named 666 that is automatically recreated if deleted? I think it may be a virus, but I've run a Techtools virus scan and didn't find anything. It doesn't seem to adversely effect my system, I just can't get rid of it. Any ideas? Any info much appreciated -V.P.
I wanna see movies of my dreams.
Grizzled Veteran
Join Date: Apr 2001
Location: NYC
Status: Offline
Reply With Quote
Aug 17, 2001, 10:30 AM
It definitely is a virus. Do a search, I remember reading about it in here a few months back.
Forum Regular
Join Date: Jun 2000
Location: Singapore
Status: Offline
Reply With Quote
Aug 17, 2001, 11:44 PM
Dude, thats definitely a virus. Get an Anti-virus software installed.
Reply With Quote
Aug 18, 2001, 12:13 AM
Hmmm...does this virus come preinstalled with the OS 9.1 that comes with Mac OS X? I did a clean install and I never booted into OS 9.1 but its there. Scary...
Professional Poster
Join Date: Mar 2001
Location: Florida
Status: Offline
Reply With Quote
Aug 18, 2001, 12:17 AM
It is a virus and only one app will get rid of it. It will keep coming back, clowing down your system. I had it, it killed Virex, TechTool found it but could not get rid of it. The only thing that will kill the virus is I believe


If not do a search for 666, there are a few variants of it. But I think the app above will get it!
All Your Signature Are Belong To Us!
Moderator Emeritus
Join Date: Jan 2001
Location: In a world of Infinite Keys
Status: Offline
Reply With Quote
Aug 18, 2001, 12:25 AM
Did some research on this before. 666 is an extension that will spread a virus called Seven Dust (i think) around your system. Seven Dust doesn't do anything bad to your system, but it's never good to have a virus on your computer.

The way to "solve" this is to install an application type thing that will keep the bad 666 extension out of the extensions folder.

It can be found here.

After you install it, do another scan with some virus software to get rid of SevenDust.

You remind me my wife… why you laugh? She dead. | sasper at gmail dot com
Reply With Quote
Aug 18, 2001, 02:10 AM
666, aka sevendust, is a virus that comes in several different variations. I am not a programming type who knows how it works, but here is my guess, based on experience after it exploded all over the network at the college I currently attend.

I think what it does is infect a file, and every time that file is opened, it recreates a copy of the extension. It seemed, at least in my school, to show a particular affinity to the AIM extension, which was bad news, as it meant that every time someone started up their computer, the extension was recreated. The easiest solution, of course, is simply to turn off the extensions that it has infected (use disinfectant to figure that out - it will clean all the files it can, and tell which files it cannot clean because they are running). Turn the extensions off, and run a virus checker - I use Norton, but I am sure Virex and others would work equally well. That should knock it out of your system completely. Finally, get some sort of protection that scans all the files you download, as this seems to be the way one gets infected.

I think the virus is mainly harmless, but I have heard of variations which damage files - so I would definitely get rid of it if you have it.
Clinically Insane
Join Date: Apr 2000
Status: Offline
Reply With Quote
Aug 18, 2001, 02:29 AM
Sevendust kills Disinfectant.

I had it a while ago - had to kill it manually.

It checks An infected app checks for the presence of the extension - if its missing or altered, recreates it, overriding Finder locks and naming rules.

The extension, when in memory, infects every launched app.

Its a symbiote circle.

Virex 6 will kill it.

Blot: Could you please remove the animation form the signature, and ensure that its under 10K. Thanks

[ 08-18-2001: Message edited by: Cipher13 ]
Thread Tools
Forum Links
Forum Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On
Privacy Policy
All times are GMT -4. The time now is 09:54 AM.
All contents of these forums © 1995-2015 MacNN. All rights reserved.
Branding + Design: www.gesamtbild.com
vBulletin v.3.8.8 © 2000-2015, Jelsoft Enterprises Ltd., Content Relevant URLs by vBSEO 3.3.2