SevenDust (computer virus)

{{Infobox computer virus

| Common name = SevenDust

| Technical name = SevenDust

| Family = SevenDust

| Aliases = SevenDust.a, .b, .c, .d, .e, .f, .g; 666; MDEF 666, 9806, E; Graphics Accelerator; SevenD

| Classification = Virus

| Type = Classic Mac OS

| Subtype =

| isolation_date = 1998

| Isolation =

}}

SevenDust is a computer virus that infects computers running certain versions of the classic Mac OS. It was first discovered in 1998,{{cite web|url=http://securityresponse.symantec.com/avcenter/venc/data/mac-sevendust.html |archive-url=https://web.archive.org/web/20020808021419/http://securityresponse.symantec.com/avcenter/venc/data/mac-sevendust.html |url-status=dead |archive-date=August 8, 2002 |title=MacOS.Sevendust}}{{cite web|url=https://home.mcafee.com/virusinfo/virusprofile.aspx?key=99884 |title=MacOS/SevenDust Virus Profile & Definition McAfee Inc.}} and originally referred to as 666 by Apple.

SevenDust is a polymorphic virus, with some variant also being encrypted. It spreads by users running an infected application program (executable).{{cite web|url=https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/Mac~Sevendust-A/detailed-analysis.aspx |title=Detailed Analysis - Mac/Sevendust-A - Viruses and Spyware - Advanced Network Threat Protection ATP from Targeted Malware Attacks and Persistent Threats sophos.com - Threat Center |accessdate=23 February 2017}} Some variants of SevenDust also delete all non-application files accessed during certain times.

Virex 6.1 (with 2007 virus definitions) is one example of a classic Macintosh anti-virus program which is compatible with System 7.5.5 and can detect and often remove SevenDust, if run on non-infected system. Alternatively, ResEdit can be used to open the "666" Extension (in the active System folder) and to delete all resources inside; then the "666" Extension must be saved and Locked. Rebooting would then allow Virex to disinfect the drive. After disinfection is complete, all drives should be searched for any "666" Extensions remaining, and any found should be deleted.