Path: utzoo!attcan!uunet!portal!cup.portal.com!MacUserLabs
From: MacUserLabs@cup.portal.com (Stephan - Somogyi)
Newsgroups: comp.sys.mac
Subject: Re: SuperLaserSpool (was Re: nVIR ...)
Message-ID: <13655@cup.portal.com>
Date: 18 Jan 89 18:28:14 GMT
References: <11756@dartvax.Dartmouth.EDU> <13582@cup.portal.com> <24192@cornell.UUCP>
Organization: The Portal System (TM)
Lines: 25

I was immediately corrected by someone at SuperMac that SLS was in
fact an INIT; my apologies, it was my error.

Nonetheless, SLS contains a jump table and CODE. The guy here at the
office who uses SLS swears that when it becomes active, he gets a
little icon for it in his MultiFinder menu. I guess calling SLS a
hybrid would be more accurate.

Regardless of the terminology question, nVIR propagates when TEInit is
called; it then patches CODE 0 to point to the virus. After the viral
code is done, nVIR executes the jump table entry that was replaced.
SLS is succeptible to this.

Stephan

<- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - ->
Stephan Somogyi                           AppleLink: X1058  
Software Engineer                         BIX: mulabs       
MacUser Labs                              CIS: 72511,16
950 Tower Lane, 18th Floor                GEnie, MacNET: MULABS
Foster City, CA 94404                     FAX: (415) 378-5675

...sun!cup.portal.com!MacUserLabs or MacUserLabs@cup.portal.com

Any opinions expressed above are mine.