This is a virus detection. Viruses are programs that self-replicate recursively, meaning that infected systems spread the virus to other systems, which then propagate the virus further. While many viruses contain a destructive payload, it's quite common for viruses to do nothing more than spread from one system to another.
Indication of Infection
Presence of '666' or '\001Graphics Accelerator' in the Extensions folder. Note that the extension dropped by the virus has an invisible character in front which makes it difficult to distinguish the file from a legitimate video driver from ATI that has 'Graphics Accelerator' name! The latest variant may drop its extension under different names but always has the first invisible character.
Variants .a-.d do not have any damaging payload. But computers infected with the most common variant (aka 'Graphics Accelerator') erase all non-application files started during the sixth hour of the 6th or 12th day of any month.
Methods of Infection
Members of this family hit MDEF and INIT resources. Infected applications have MDEF resource, the System has INIT. There are seven known variants:
Only hits MDEF 666 and INIT 666 resources. Drops extension '666'. Size is 850 bytes.
Only hits MDEF 666 and INIT 666 resources. Drops extension '666'. Size is 1342 bytes.
Hits MDEF and INIT resources with random IDs (from 1 to 255). Drops extension '666'. Carries 'BACH' string for self-recognition. Size is 1576 bytes.
Hits MDEF and INIT resources with random IDs (from 1 to 255). Drops extension '666'. Carries 'BACH' string for self-recognition. Size is 2036 bytes.
Also known as MDEF-E virus. Hits MDEF and INIT resources with random IDs. Carries "JSBACH" string (apparently an abbreviation for Johann Sebastian Bach). When this variant infects an MBDF resource it saves its original contents in the encrypted form along with the encrypted virus body.
Hit MDEF and INIT resources with random IDs and carry "JS" string for self-recognition. When this variant infects some MBDF resource it saves its original contents in the encrypted form along with the encrypted virus body. Drop extension '\001Graphics Accelerator', 'ExtensionConflicts' or introduce an INIT in the System file. Dropped extension file carries the virus body in the INIT 33 resource. These variants will modify 'WIND' resource to complicate removal (so-called symbiotic property). The 'MENU' resource is overwritten with the character 'f' (hexadecimal 66).
Note: Even though this virus strain used '666' label there is no reason to believe that it has any relation to the Spanish 29A virus writing group (hexadecimal for 666 is 0x29A).
666, Graphics Accelerator, Mac/SevenD, Mac/Sevendust , MDEF 666, MDEF 9806, MDEF E