TweetFollow Us on Twitter

Virus
Volume Number:4
Issue Number:5
Column Tag:Advanced Mac'ing

A Vaccine for the 'nVIR' Virus

By Mike™ Scanlin, Contributing Editor

Unless you are going to Africa or Indochina, viruses and vaccinations are not something that most of us need to worry about. However, even if you’re not planning on travelling, there is one virus you need to be aware of. It is a computer virus that is infecting Macintoshes everywhere. [Note: The virus described in this article is apparently only one of at least three viruses that are going around as reported in the press. This article discusses what we shall name the ‘nVIR’ virus. The other two are the infamous ‘peace message’ virus and the ‘scrapbook’ virus reported in this month’s mousehole column, and in a recent MacWeek article. -Ed]

Are you infected?

Use ResEdit to open your system file and look for ‘nVIR’ resources. If you have them, then your system has been infected and chances are that at least some (if not most or all) of your applications are infected. Don’t panic. This particular virus is relatively harmless. There is an application at the end of this article that will allow you to remove the virus from your infected applications. There is also an ‘INIT’ resource you can put in your System Folder that will warn you if this virus ever shows up on your system. [Note that this vaccine and virus warning init applies only to this particular ‘nVIR’ virus. New vaccines will be necessary for the other two once it is known how they operate. -Ed]

Fig. 1 Vaccination Alert tells Application status

How I found it

Until last week, I had had no experience with computer viruses. I had heard rumors about the existence of Mac viruses, but didn’t really believe them. I do not know when this virus first got into my system. It must have come from some program I downloaded off of a network, but I do not know which one. By the time I figured out what was going on, the virus had modified seventeen of the applications on my hard disk and my System file.

Virus Symptoms

Sometime near the beginning of last week, I started hearing a beep when launching programs. It didn’t happen every time, only once in a while and with no discernable pattern. Using TMON, I trapped SysBeep() and discovered that something was modifying ‘CODE’ 0 and installing several ‘nVIR’ resources into every application I launched. I looked in my System file and, in addition to several ‘nVIR’ resources, found an ‘INIT’ 32 resource that I didn’t put there. I compared the standard ‘INIT’s from an original system disk and none of them matched the ‘INIT’ 32 I had found. What really clued me in to the idea of a virus was that if I took the ‘INIT’ 32 resource out of my System file, quit ResEdit, and then relaunched ResEdit, the ‘INIT’ 32 resource would be back in there. After disassembling ‘INIT’ 32, I learned how it worked and how to make my system immune to it. I am sharing this information so that other Mac users can protect themselves as well. [Note that this virus exhibits the ability to re-install itself after being patched out with ResEdit! -Ed]

How to make your System file immune

Use ResEdit to open your System file. Create an ‘INIT’ 32 resource that consists of these 2 hex bytes: 4E 75 (which is an RTS instruction). If ‘INIT’ 32 already exists and has a size of 366 bytes, then you can be pretty sure it is the virus’ ‘INIT’. Replace the existing ‘INIT’ 32 with the 2 byte version (4E 75). Now create 8 resources of the type ‘nVIR’; the case of the resource type is important -- do not use ‘NVIR’ or ‘nvir’. Their IDs should be 0 through 7, with size zero bytes. If they already exist, then delete them and create 8 new empty ones (with IDs 0-7).

That’s it. Your system is now immune to this particular virus (but not all possible viruses). If you now run an infected application, the virus will think that it is already installed in your system file, since it sees the ‘INIT’ and ‘nVIR’ resources it expects, and will leave it alone.

If your System file was infected before you immunized it, you should reboot the system before using the procedure below to remove the virus from your applications. This guarantees that the effects of ‘INIT’ 32 are removed from memory.

Removing the virus from infected applications

If an application has been infected, it will have several ‘nVIR’ resources, a ‘CODE’ 256 resource, and a possibly modified ‘CODE’ 0 resource. Here are instructions on how to restore an infected application (note: this is only useful if you are certain that your System file is not infected. Otherwise, the applications will become infected again. Also, you should practice on a copy of an infected application):

1) Open the application with ResEdit. If ‘CODE’ 256 exists, use GetInfo on it to check its size. If it is 372 bytes, then remove it. The reason we check for the size is because some applications, such as ReadySetGo, already have a ‘CODE’ 256 resource of their own and we don’t want to remove part of the application’s code.

2) Open ‘CODE’ 0 and look at the 3rd line of 8 hex bytes (bytes 16-23). If it is “0000 3F3C 0100 A9F0” then you need to replace that line of hex numbers with the 8 bytes contained in the ‘nVIR’ 2 resource. If the third line does not look like the above 8 bytes, then the ‘CODE’ resource is probably protected and did not get modified -- see below for an explanation. In this case leave it alone.

3) Remove all ‘nVIR’ resources. Make sure you have completed step 2 before removing ‘nVIR’ 2. You cannot restore the application without it.

Because this procedure is so automatic, I have written a program that does it for you. The application Vaccination displays the SFGetFile dialog and allows you to choose an application to vaccinate. A message is displayed that tells you the result of the vaccination and the SFGetFile dialog is displayed again. If your system has been infected, you should vaccinate every application on your hard drive. You will only see files of type ‘APPL’, ‘FNDR’ (for the Finder), and ‘dahd’ (for the DA handler) in the SFGetFile dialog so you might want to do a manual tree walk of your hard drive to be sure you vaccinate all of your applications. There is no harm in vaccinating an uninfected application or in vaccinating the same application more than once. This program does not make applications immune to this virus, it only removes this virus from them. But if your System file is immune, then there is no way this particular virus can spread to your applications. Note: you cannot use the Vaccination program to make your System file immune. You will have to do that manually using the procedure above.

How this virus works

This particular virus modifies the ‘CODE’ 0 resource of an application in such a way that when you launch that application the first thing to execute is a piece of virus installation code. That installation code looks for the virus’ presence in the System file you are launching from. If it does not find evidence of the virus, it then installs itself (as ‘INIT’ 32 and several ‘nVIR’ resources) into your System file and then executes the application you had originally launched. Once your System file is infected, every application launched from that system will become infected. The whole infection process only takes a second or two, so there is little chance you will notice it. If the virus detects that it is already in the System file and in the application you are launching (meaning that no installation of itself is necessary on this launch), then there is about a 6% chance (1 in 16) that you will hear a short beep. This is the beep that first got my attention. According to a friend of mine, Chris Borton, whose computer was also infected, if you have MacinTalk in your System Folder, then the virus speaks the words “Don’t Panic” instead of beeping.

This virus does not check if the ‘CODE’ 0 resource of the application it is trying to infect is protected or not. Consequently, applications that have ‘CODE’ 0 resources with the resProtected bit set are still infected, but are not contagious, i.e. they have the ‘CODE’ 256 resource and the ‘nVIR’ resources added to them, but they can not pass the virus on to a clean System file. I learned this by noticing that QUED/M and PageMaker were infected, but were not contagious. I couldn’t figure out why some programs had protected ‘CODE’ resources and others didn’t. Then one of the people I work with, Victor Romano, put it together. He told me that Lightspeed C (which QUED/M and PageMaker were written in) automatically sets the resProtected bit of the ‘CODE’ resources it generates. MPW does not. So, protecting the ‘CODE’ resources (which can be done with ResEdit) is another simple way of preventing this virus from affecting an application.

To be forewarned

I don’t know how far this virus has already spread, or how far it will spread. As a partial defense, however, I have written a piece of code that can be installed as an ‘INIT’ file in your System Folder that will warn you if it detects something that looks like this particular virus. VirusWarnINIT is a patch on 2 routines that this virus relies on: GetResource() and ChangedResource(). The patch to GetResource() makes a beep if theType == ‘nVIR’. The patch to ChangedResource() makes a beep if theResource is a handle to a ‘CODE’ 0 resource. I wouldn’t suggest installing this ‘INIT’ in a system known to be infected -- the number of beeps is sure to annoy you. I would have used something like an alert window instead of a beep as a warning, but I can’t be sure that the Window Manager has been initialized at the time the virus is detected. If you install this ‘INIT’ in a clean system and then launch a contagious application, you will hear about 5 or 6 beeps in a row as the virus tries to install itself in your System file.

Note that this ‘INIT’ is only a warning, not a vaccination. The virus will still install itself. The advantage is that you will know about it right away and can stop it before it spreads very far.

Now that my Mac has been vaccinated, it’s my turn. After Typhoid, Yellow Fever, Cholera and Meningococcal vaccinations, I’m off to Africa and Indochina. I wonder if I can get David Smith to send MacTutor to Serengeti National Park? Or do they already get it there? I’ll let you know

/* Vaccination.c
   * by Mike™ Scanlin   12 March 88
   *
   * Removes the ‘nVIR’ virus from an 
 * application chosen by the user.
  */
  
#include“QuickDraw.h”
#include“ResourceMgr.h”
#include“StdFilePkg.h”
#include“FileMgr.h”

#define NIL 0L
#define reg register

#define REPORT_STATUS_ALERT 129

#define nVIR_CODE_256_SIZE372

#define nVIR2Bad -10
#define nVIR2NotFound-11

void    RemoveResourceFromFile(long theType, int theID, int    
 refNum);
intInnoculate(Str255 *fileName, int vRef);
void    pStrCpy(char *p2, char *p1);
Boolean ChooseFile(Str255 *fn, int *vRef);
void    main(void);

static  SFReply  reply;
static  int applResFile;


/* RemoveResourceFromFile(theType, theID, refNum)
   *
   * This will remove the resource of type theType 
 * and ID theID from the open resource file
   * whose refNum is refNum.
  */
void  RemoveResourceFromFile(theType, theID, refNum)
long  theType;
inttheID;
intrefNum;
{
 reg Handle theResource;
 
 if ((theResource = GetResource(theType, theID)) && (HomeResFile(theResource) 
== refNum))
 RmveResource(theResource);
}

/* Innoculate(fileName, vRef)
  *
  * This removes the ‘nVIR’ virus from *fileName 
 in directory vRef.
  */
int     Innoculate(fileName, vRef)
reg Str255*fileName;
intvRef;
{
 reg Handle oldCODE, currentCODE;
 reg inti, refNum, returnVal;
 ParamBlockRec   pb;
 
 /* init the ParamBlockRec to all zeros */
 asm {
 lea    pb,A0
 move.l #sizeof(ParamBlockRec),D0
 subq.l #1,D0
 
 @1clr.b(A0)+
 dbra D0,@1
 }
 
 /* set the current working directory */
 pb.ioParam.ioVRefNum = vRef;
 PBHSetVol(&pb, FALSE);
 
 refNum = OpenResFile(fileName);
 
 if ((oldCODE = GetResource(‘nVIR’, 2)) && (HomeResFile(oldCODE) == refNum)) 
{
 if (GetHandleSize(oldCODE) != 8)
 /* if ‘nVIR’ 2 isn’t 8 bytes, then something 
 isn’t right. */
 returnVal = nVIR2Bad;
 else {
 if ((currentCODE = GetResource(‘CODE’, 0)) && (HomeResFile(currentCODE) 
== refNum)) {
 asm {
 MOVE.L oldCODE, A1
 MOVE.L (A1),A1
 MOVE.L currentCODE, A0
 MOVE.L (A0),A0
 ADDA #16, A0
 MOVE.L (A1)+, (A0)+
 MOVE.L (A1), (A0)
 }
 ChangedResource(currentCODE);
 }
 
 /* kill the ‘nVIR’ resources */
 for (i = 0; i <= 7; i++)
 RemoveResourceFromFile(‘nVIR’, i, refNum);

 /* kill the extra ‘CODE’ resource that this 
 virus adds (only if it has the size 
 of nVIR_CODE_256_SIZE) */
 if ((currentCODE = GetResource(‘CODE’, 256)) &&
 (GetHandleSize(currentCODE) == 
 nVIR_CODE_256_SIZE) && (HomeResFile(currentCODE) 
 == refNum))
 RmveResource(currentCODE);
 
 returnVal = noErr;
 }
 }
 else
 returnVal = nVIR2NotFound;
 
 if (refNum != applResFile)
 CloseResFile(refNum);
 
 return(returnVal);
}

/* pStrCpy(p2, p1)
  *
  * Copy the pascal string at *p1 to *p2.
  */
void pStrCpy(p2, p1)
reg char*p2, *p1;
{
 reg intlen;
 
 len = *p2++ = *p1++;
 while (--len >= 0) 
 *p2++ = *p1++;
}


/* ChooseFile(fn, vRef)
   *
   * Use SFGetFile() to get the name of an 
 * application from the user. Return the directory
   * of the chosen file in *vRef. Return FALSE if the 
 * user clicked Cancel, TRUE if they clicked
   * Open.
  *
  * Thanks to Chris Borton for this routine.
  */
Boolean ChooseFile(fn, vRef)
Str255  *fn;
int*vRef;
{
 SFTypeList myTypes;
 static Point  SFGwhere = { 90, 82 };
 
 myTypes[0] = ‘APPL’;
 myTypes[1] = ‘FNDR’;
 myTypes[2] = ‘dahd’;
 
 SFGetFile(SFGwhere, NIL, 0L, 3, myTypes, 0L, &reply);
 if (reply.good) {
 pStrCpy((char *)fn , (char *)reply.fName);
 *vRef = reply.vRefNum;
 return(TRUE);
 }
 else
 return(FALSE);
}

void main() {
 
 Str255 fileName;
 int    vRef;
 
 /* save the application’s resource file refNum */
 applResFile = CurMap;
 
 InitGraf(&thePort);
 InitFonts();
 InitWindows();
 InitMenus();
 InitDialogs(0L);
 InitCursor();

 /* keep choosing files until the user hits Cancel */
 while (ChooseFile(&fileName, &vRef)) {
 switch (Innoculate(&fileName, vRef)) {
 case   nVIR2Bad:
 ParamText(&fileName, “\pResource ‘nVIR’ 2 is not 8 bytes long. File 
cannot be repaired.”, NIL, NIL);
 break;
 case nVIR2NotFound:
 ParamText(&fileName, “\pResource ‘nVIR’ 2 not found. File is not infected 
or cannot be repaired.”, NIL, NIL);
 break;
 default:
 ParamText(&fileName, “\pVirus successfully removed.”, NIL, NIL);
 }
 
 /* show the result of the attempted removal */
 Alert(REPORT_STATUS_ALERT, NIL);
 }
}


/* VirusWarnINIT.c
   * by Mike™ Scanlin   13 March 88
   *
   * Put this in your system folder to warn you 
 * about the ‘nVIR’ virus.
   * It patches GetResource() and ChangedResource().
  */
  
#include “Asm.h”
#include “ResourceMgr.h”

#define GetResource0xA9A0
#define ChangedResource 0xA9AA
#define JMP 0x4EF9
#define memFullErr -108
#define beepDuration 20

void  main(void);

void  main()
{
 asm  {

/* beginning of the code that installs the patches */

 move.l D3,-(SP)
 
/* get the original GetResource address */   
 move #GetResource,D0
 _GetTrapAddress
/* set up the JMP instruction that calls the original GetResource */
 lea    @origGR,A1
 move #JMP,(A1)+
 move.l A0,(A1)

/* get the original ChangedResouce address */
 move #ChangedResource,D0
 _GetTrapAddress
/* set up the JMP instruction that calls the original ChangedResource 
*/
 lea    @origCR,A1
 move #JMP,(A1)+
 move.l A0,(A1)

/* get some space in the system heap for the patches */
 lea    @last,A0
 lea    @first,A1
 suba.l A1,A0    /* the length of our patches */
 move.l A0,D0
 add.l  #254,D0  /* the extra space for the Str255 at the end (@name) 
*/
 move.l D0,D3    /* save for _BlockMove */
 _NewPtrSYS
 cmpi   #memFullErr,D0
 beq.s  @noPatch
 move.l A0,-(SP) /* save for _BlockMove */
 move.l (SP),-(SP) /* for _SetTrapAddress */

/* set GetResource to the beginning of the space we just got in the system 
heap */
 move #GetResource,D0
 _SetTrapAddress

/* set ChangedResource trap */
 lea    @changedResouce,A0
 lea    @getResource,A1
 suba.l A1,A0
 adda.l (SP)+,A0
 move #ChangedResource,D0
 _SetTrapAddress
 
/* now move it into place */
 lea    @first,A0
 move.l (SP)+,A1
 move.l D3,D0
 _BlockMove

@noPatchmove.l (SP)+,D3
 rts
 
/* end of the code that installs the patches */

@first  

/*
  * This is the patch to GetResource
  *
  */
@getResource
 move.l 6(SP),D0 /* get theType */
 cmpi.l #’nVIR’,D0
 bne.s  @origGR

/* at this point we know something is trying to load an ‘nVIR’ resource 
*/ 
 move #beepDuration,-(SP)
 _SysBeep
/* note that this is only a warning beep, it falls through 
 * to the original GetResource, so the calling function 
 * never knows that it was detected. */
@origGR nop /* JMP to original trap */
 nop
 nop

/*
  * This is the patch to ChangedResource
  *
  */
@changedResouce

/* call GetResInfo() to see if we are changing a CODE 0 resource */
 move.l 4(SP),-(SP)/* copy the resource handle 
 * that was passed to
   * ChangedResouce() */
 pea    @theID
 pea    @theType
 pea    @name
 _GetResInfo
 
 lea    @theType,A0
 move.l (A0),D0
 cmpi.l #’CODE’,D0
 bne.s  @origCR
 
 lea    @theID,A0
 tst    (A0)
 bne.s  @origCR

/* give a warning beep a CODE 0 resource is being changed */   
 
 move #beepDuration,-(SP)
 _SysBeep
 
@origCR nop /* JMP to original trap */
 nop
 nop
 
@theID  dc0
@theTypedc.l0
@name   dc0 
 /* there are actually 254 more bytes to this
 * variable (for a total of 256). Check the
 * add.l #254,D0 instruction in the install code. */

@last
 }
}
 

Community Search:
MacTech Search:

Software Updates via MacUpdate

Arq 5.8.5 - Online backup to Google Driv...
Arq is super-easy online backup for Mac and Windows computers. Back up to your own cloud account (Amazon Cloud Drive, Google Drive, Dropbox, OneDrive, Google Cloud Storage, any S3-compatible server... Read more
Backblaze 4.3.0.44 - Online backup servi...
Backblaze is an online backup service designed from the ground-up for the Mac. With unlimited storage available for $5 per month, as well as a free 15-day trial, peace of mind is within reach with... Read more
Instaradio 7.1 - Listen to your favorite...
Instaradio is fast, and it could be the radio player you have been waiting for. Try the app thousands of people rely on for listening to radio. Features Listen to radio from all around the world... Read more
EtreCheck 3.3.3 - For troubleshooting yo...
EtreCheck is an app that displays the important details of your system configuration and allow you to copy that information to the Clipboard. It is meant to be used with Apple Support Communities to... Read more
Hopper Disassembler 4.2.1- - Binary disa...
Hopper Disassembler is a binary disassembler, decompiler, and debugger for 32-bit and 64-bit executables. It will let you disassemble any binary you want, and provide you all the information about... Read more
Slack 2.6.2 - Collaborative communicatio...
Slack is a collaborative communication app that simplifies real-time messaging, archiving, and search for modern working teams. Version 2.6.2: Fixed Inexplicably, context menus and spell-check... Read more
Apple Final Cut Pro X 10.3.4 - Professio...
Apple Final Cut Pro X is a professional video editing solution.Completely redesigned from the ground up, Final Cut Pro adds extraordinary speed, quality, and flexibility to every part of the post-... Read more
Numi 3.15 - Menu-bar calculator supports...
Numi is a calculator that magically combines calculations with text, and allows you to freely share your computations. Numi combines text editor and calculator Support plain English. For example, '5... Read more
TunnelBear 3.0.14 - Subscription-based p...
TunnelBear is a subscription-based virtual private network (VPN) service and companion app, enabling you to browse the internet privately and securely. Features Browse privately - Secure your data... Read more
Apple iMovie 10.1.6 - Edit personal vide...
With an all-new design, Apple iMovie lets you enjoy your videos like never before. Browse your clips more easily, instantly share your favorite moments, and create beautiful HD movies and Hollywood-... Read more

Latest Forum Discussions

See All

Goat Simulator PAYDAY (Games)
Goat Simulator PAYDAY 1.0 Device: iOS Universal Category: Games Price: $4.99, Version: 1.0 (iTunes) Description: ** IMPORTANT - SUPPORTED DEVICES **iPhone 4S, iPad 2, iPod Touch 5 or better Goat Simulator: Payday is the most... | Read more »
Zombie Gunship Survival Beginner's...
The much anticipated Zombie Gunship Survival is here. In this latest entry in the Zombie Gunship franchise, you're tasked with supporting ground troops and protecting your base from the zombie horde. There's a lot of rich base building fun, and... | Read more »
Mordheim: Warband Skirmish (Games)
Mordheim: Warband Skirmish 1.2.2 Device: iOS Universal Category: Games Price: $3.99, Version: 1.2.2 (iTunes) Description: Explore the ruins of the City of Mordheim, clash with other scavenging warbands and collect Wyrdstone -... | Read more »
Mordheim: Warband Skirmish brings tablet...
Legendary Games has just launched Mordheim: Warband Skirmish, a new turn-based action game for iOS and Android. | Read more »
Magikarp Jump splashes onto Android worl...
If you're tired ofPokémon GObut still want something to satisfy your mobilePokémon fix,Magikarp Jumpmay just do the trick. It's out now on Android devices the world over. While it looks like a simple arcade jumper, there's quite a bit more to it... | Read more »
Purrfectly charming open-world RPG Cat Q...
Cat Quest, an expansive open-world RPG from former Koei-Tecmo developers, got a new gameplay trailer today. The video showcases the combat and exploration features of this feline-themed RPG. Cat puns abound as you travel across a large map in a... | Read more »
Jaipur: A Card Game of Duels (Games)
Jaipur: A Card Game of Duels 1.0 Device: iOS Universal Category: Games Price: $1.99, Version: 1.0 (iTunes) Description: ** WARNING: iPad 2, iPad Mini 1 & iPhone 4S are NOT compatible. ** *** Special Launch Price for a limited... | Read more »
Subdivision Infinity (Games)
Subdivision Infinity 1.03 Device: iOS Universal Category: Games Price: $2.99, Version: 1.03 (iTunes) Description: Launch sale! 40% Off! Subdivision Infinity is an immersive and pulse pounding sci-fi 3D space shooter. https://www.... | Read more »
Clash of Clans' gets a huge new upd...
Clash of Clans just got a massive new update, and that's not hyperbole. The update easily tacks on a whole new game's worth of content to the hit base building game. In the update, that mysterious boat on the edge of the map has been repaired and... | Read more »
Thimbleweed Park officially headed to iO...
Welp, it's official. Thimbleweed Park will be getting a mobile version. After lots of wondering and speculation, the developers confirmed it today. Thimbleweed Park will be available on both iOS and Android sometime in the near future. There's no... | Read more »

Price Scanner via MacPrices.net

Free Tread Wisely Mobile App Endorsed By Fath...
Just in time for the summer driving season, Cooper Tire & Rubber Company has announced the launch of a new Tread Wisely mobile app. Designed to promote tire and vehicle safety among teens and... Read more
Commercial Notebooks And Detachable Tablets W...
Worldwide shipments of personal computing devices (PCDs), comprised of traditional PCs (a combination of desktop, notebook, and workstations) and tablets (slates and detachables), are forecast to... Read more
Best value this Memorial Day weekend: Touch B...
Apple has Certified Refurbished 2016 15″ and 13″ MacBook Pros available for $230 to $420 off original MSRP. An Apple one-year warranty is included with each model, and shipping is free: - 15″ 2.6GHz... Read more
13-inch MacBook Airs on sale for up to $130 o...
Overstock.com has 13″ MacBook Airs on sale for up to $130 off MSRP including free shipping: - 13″ 1.6GHz/128GB MacBook Air (sku MMGF2LL/A): $869.99 $130 off MSRP - 13″ 1.6GHz/256GB MacBook Air (sku... Read more
2.8GHz Mac mini available for $973 with free...
Adorama has the 2.8GHz Mac mini available for $973, $16 off MSRP, including a free copy of Apple’s 3-Year AppleCare Protection Plan. Shipping is free, and Adorama charges sales tax in NY & NJ... Read more
15-inch 2.2GHz Retina MacBook Pro on sale for...
Amazon has 15″ 2.2GHz Retina MacBook Pros (MJLQ2LL/A) available for $1749.99 including free shipping. Apple charges $1999 for this model, so Amazon’s price is represents a $250 savings. Note that... Read more
Huawei Unveils New ‘Business-Styled’ MateBook...
Huawei has introduced a trio of new MateBook laptops, expanding its mobile portfolio and building on its success in delivering attractive and powerful high-end devices. The company claims the HUAWEI... Read more
Deal! Gold 12-inch 1.2GHz Retina MacBook for...
Amazon has the 2016 Gold 12″ 1.2GHz Retina MacBook (MLHF2LL/A) on sale for $350 off MSRP for a limited time. Shipping is free: - 12″ 1.2GHz Gold Retina MacBook: $1249.99 $350 off MSRP We expect this... Read more
13-inch 2.0GHz MacBook Pros on sale for $100...
B&H has the non-Touch Bar 13″ 2.0GHz MacBook Pros in stock today and on sale for $100 off MSRP. Shipping is free, and B&H charges NY & NJ sales tax only: - 13″ 2.0GHz MacBook Pro Space... Read more
15-inch 2.2GHz Retina MacBook Pro, Apple refu...
Apple has Certified Refurbished 2015 15″ 2.2GHz Retina MacBook Pros available for $1699. That’s $300 off MSRP, and it’s the lowest price available for a 15″ MacBook Pro. An Apple one-year warranty is... Read more

Jobs Board

*Apple* Retail - Multiple Positions, White P...
Sales Specialist - Retail Customer Service and Sales Transform Apple Store visitors into loyal Apple customers. When customers enter the store, you're also the Read more
Best Buy *Apple* Computing Master - Best Bu...
**509110BR** **Job Title:** Best Buy Apple Computing Master **Location Number:** 000048-Topeka-Store **Job Description:** **What does a Best Buy Apple Computing Read more
*Apple* Retail - Multiple Positions - Apple,...
Job Description: Sales Specialist - Retail Customer Service and Sales Transform Apple Store visitors into loyal Apple customers. When customers enter the store, Read more
*Apple* Retail - Multiple Positions - Apple,...
Job Description:SalesSpecialist - Retail Customer Service and SalesTransform Apple Store visitors into loyal Apple customers. When customers enter the store, Read more
*Apple* Systems Engineer - California Polyte...
Cal Poly, San Luis Obispo Apple Systems Engineer Department: ITS - Customer & Tech Support (134900) College/Division: Academic Affairs Salary Range: Position Read more
All contents are Copyright 1984-2011 by Xplain Corporation. All rights reserved. Theme designed by Icreon.