Path: utzoo!attcan!utgpu!jarvis.csri.toronto.edu!mailrus!csd4.milw.wisc.edu!leah!rpi!rpi.edu!deven
From: deven@rpi.edu (Deven Corzine)
Newsgroups: comp.sys.amiga
Subject: Re: Resident programs
Message-ID: <DEVEN.89May17133054@daniel.rpi.edu>
Date: 17 May 89 17:30:54 GMT
References: <1331@rivm05.UUCP>
Sender: usenet@rpi.edu
Organization: RPI Public Access Workstation Lab, Troy NY
Lines: 23
In-reply-to: ccemdd@rivm.UUCP's message of 16 May 89 12:41:56 GMT

In article <1331@rivm05.UUCP> ccemdd@rivm.UUCP (Marco Dedecker) writes:

   I've made my own virus detection program, to detect a resident program
   (possible virus) in memory.

   It checks :
	   - The coolcapture.
	   - The coldcapture.
	   - The interrupt vectors.
	   - KickTagPtr.

What I want to know is how these vectors work.  Not the interrupts,
but coolcapture, coldcapture and KickTagPtr.  There are programs I
would like to have survive a warm boot...

Where are these documented?

Deven
--
shadow@[128.113.10.2]   <shadow@pawl.rpi.edu> Deven T. Corzine (518) 272-5847
shadow@[128.113.10.201] <shadow@acm.rpi.edu>  2346 15th St.    Pi-Rho America
deven@rpitsmts.bitnet   <userfxb6@rpitsmts>   Troy, NY 12180-2306  <<tionen>>
"Simple things should be simple and complex things should be possible." - A.K.