Path: utzoo!attcan!uunet!aplcen!uakari.primate.wisc.edu!zaphod.mps.ohio-state.edu!unix.cis.pitt.edu!dsinc!netnews.upenn.edu!vax1.cc.lehigh.edu!cert.sei.cmu.edu!krvw From: XRJDM@SCFVM.GSFC.NASA.GOV (Joe McMahon) Newsgroups: comp.virus Subject: Re: viruses in sound effects (Mac) Message-ID: <0002.9010011435.AA28524@ubu.cert.sei.cmu.edu> Date: 28 Sep 90 04:17:33 GMT Sender: Virus Discussion List Lines: 30 Approved: krvw@sei.cmu.edu pjc@sirius.melb.bull.oz.au (Paul Carapetis) writes: >It is my belief that any file on the mac which is capable of >displaying itself as an icon has executable code to do so. If this is >true, then ANY file is open to infection by a virus designed to take >advantage of this. This is incorrect. Display of icons is done by the Finder. The icons themselves come from a special resource file known as the Desktop, which is built incrementally as new files are written onto the disk. Icons are added to this file only when the new file contains what is known as a "bundle", a set of resources which map file types and creators to icons. You can see this happen by copying a document for which you do not have the application onto a disk. The document will show up as the "generic document" (the dog-eared page icon). When the application to which the file belongs is added to the disk, the document will acquire its proper icon (the window in which it lives must be closed and reopened for this to happen). You may have been confused by the description of some of the Mac viruses such as WDEF and CDEF. These viruses essentially override the "standard" resources of the same type, and add their virus code on top. >Of course, it is very possible that I have been mis-informed and the >above premise is totally incorrect, in which case, I apologise in >advance. No problem. We're always happy to educate. --- Joe M.