Xref: utzoo comp.sys.amiga.misc:4615 comp.sys.amiga.programmer:4556
Path: utzoo!utgpu!news-server.csri.toronto.edu!rpi!think.com!sdd.hp.com!wuarchive!uunet!littlei!intelhf!agora!robart
From: robart@agora.rain.com (Robert Barton)
Newsgroups: comp.sys.amiga.misc,comp.sys.amiga.programmer
Subject: Re: Unknown residents (virus?)
Keywords: Residents Virus virus
Message-ID: <1991Jun15.060626.9832@agora.rain.com>
Date: 15 Jun 91 06:06:26 GMT
References: <1991Jun14.091133.1684@gdt.bath.ac.uk>
Organization: Agora
Lines: 12

In article <1991Jun14.091133.1684@gdt.bath.ac.uk> ccspad@gdt.bath.ac.uk (P A Dale) writes:
>He was checking out the residents list using ARTM (PAL version)
>and noticed two unattributed residents (marked unknown rather than
>say a library). I checked my list as well and sure enough there
>they were. The first has the name <something>hookMJ, with the MJ in reverse
>video and is at a priority of 5. The "hook" part makes me nervous. Then down
>at the bottom of the list is "strap" and a priority of -60!


  These are both legitimate.  The first one is probably alert.hook.
The reverse video MJ is CTRL-M CTRL-J, or in other words CR LF.  It
looks like ARTM is looking at the IdString rather than the Name field.