Path: utzoo!utgpu!news-server.csri.toronto.edu!bonnie.concordia.ca!uunet!zaphod.mps.ohio-state.edu!unix.cis.pitt.edu!dsinc!netnews.upenn.edu!vax1.cc.lehigh.edu!cert.sei.cmu.edu!krvw From: mike@pyrite.SOM.CWRU.Edu (Michael Kerner) Newsgroups: comp.virus Subject: Re: HyperCard virus --should I wait to script? (Mac) Message-ID: <0009.9105011240.AA25914@ubu.cert.sei.cmu.edu> Date: 30 Apr 91 15:08:06 GMT Sender: Virus Discussion List Lines: 23 Approved: krvw@sei.cmu.edu O.K., Paul, much to my chagrin, the script has the _potential_ of not working since scriptors can simply change their code to get around it. I am currently working on a separate script that searches for possible viruses and trojans. So, if anyone has the code to the new German HC virus, would you please send it to me? This new script is essentially designed to work in HC 1.2.x because it appears from all the EMAIL that I'm getting that my script works (through some fluke, mind you) in 2.0v2. I am studying for finals right now and have been unable to confirm that it will still work with a virus implementing "Start using" in its script, or if I can simply intercept the message even though it may be sent directly to HC. The problem with my new script is that if there is a handler in the inheritence path that the user has set up, I won't ever see the necessary messages to do the job. This new script will search a stack when the stack opens. Options still to be worked out. Suggestions welcome. If anyone wants to run with this idea and beat me to the punch, feel free, 'cause the main thing is to get to the point where vandals get the picture that we can protect HC as well as VD, Disinfectant, and Virex can protect the rest of the Mac. Mikey.