Path: utzoo!utgpu!jarvis.csri.toronto.edu!mailrus!ncar!tank!nucsrl!accuvax.nwu.edu!jln
From: jln@accuvax.nwu.edu (John Norstad)
Newsgroups: comp.sys.mac
Subject: Re: Virus info given and wanted..
Message-ID: <10330128@accuvax.nwu.edu>
Date: 2 Feb 89 16:13:00 GMT
References: <256@melbcae.edu.au>
Organization: Northwestern U, Evanston IL, USA
Lines: 44


Hi - I'm John Norstad, the author of RWatcher.

> RWatcher is **MARVELOUS**

Thanks!  I'm very suprised that so many people seem to be using RWatcher. 
It's such a simple little INIT that it's almost a triviality.  I wrote it
for what I thought was a rather small audience (non-MPW Mac programmers),
but other people seem to be using it too.  In fact, I hacked it together
for a friend at Stanford who manages a programming lab (Lance Nakata), 
and I distributed it on INFO-MAC and comp.sys.mac.programmer as an 
afterthought.  I've always thought of RWatcher as more of a good example 
of how to write simple INITs in assembly language, rather than as a really 
significant virus fighting tool.

> One of the entries in the RLIS resource insists on being of type INIT,
> and it cannot be cleared...

I noticed this too.  I think the one I had problems with was the second
to last RLIS resource (in my distributed version 1.0).  This is a problem
with ResEdit 1.2b3, not RWatcher.  ResEdit doesn't seem to like my RLIS
template for some reason.

> ...so on some of my RLISs entries [I keep one for each virus type]
> have unused resource slots, simply because that type of virus doesn't
> have an INIT resource associated with it, like INIT29 for example. ...
> Another small problem with RWatcher is that empty resource slots in the
> RLIS resourses trigger a virus warning when you try and copy Virus Rx,
> since it contains a resource of type '    ', which would match with an
> empty slot.

I would advise against this.  Don't use empty RLIS resources.  This isn't
a problem with RWatcher, it's a problem with the way you've configured it.

By the way, INIT29 DOES have an associated INIT resource (INIT 29 - that's
how it got its name!)

John Norstad
Academic Computing and Network Services
Northwestern University

Bitnet:    jln@nuacc
Internet:  jln@acns.nwu.edu
AppleLink: a0173