Path: utzoo!attcan!utgpu!jarvis.csri.toronto.edu!mailrus!tut.cis.ohio-state.edu!cs.utexas.edu!uunet!recondo!sirius
From: sirius@recondo.UUCP (Mike Stilson)
Newsgroups: comp.sys.amiga
Subject: Re: Suggestion about new verion of virusX (are you listening Steve)
Keywords: VirusX, Guardian
Message-ID: <0855.AA0855@recondo>
Date: 9 Jun 89 16:43:31 GMT
References: <1359@rivm05.UUCP>
Followup-To: comp.sys.amiga
Lines: 20

In article <1359@rivm05.UUCP> ccemdd@rivm.UUCP (Marco Dedecker) writes:
>I strongly suggest you test the "KickTagPtr" too, the same way you
>test the "*Capture" (KickTagPtr should be 0). You musn't wait with
>testing that place after a new virus has found it's way to the
>software, test it now so that a new virus won't have a change.

Commodore's recoverable RAMdisk also sticks around by the KickTagPtr, so there's
a fair chance that it won't be 0 in many instances.  That usually isn't a nice
place to stick a virus, if you have a rrd mounted and it just disappears, then
there's a good chance something changed it, and you'd also notice it yourself.

>Marco Dedecker


--
Mike 'Sirius' Stilson      -      Sirius Software
UUCP:    sirius@recondo.UUCP
BITNET:  sirius%recondo@uunet.UU.NET
MA-BELL: (412) 793-1242 or (412) 793-5765
USNail:  1312 Universal Rd.   Penn Hills, PA  15235-3936