Path: utzoo!utgpu!water!watmath!clyde!att!osu-cis!tut.cis.ohio-state.edu!mailrus!ames!amdcad!sun!pitstop!sundc!seismo!uunet!mcvax!cernvax!ethz!macman
From: macman@ethz.UUCP (Danny Schwendener)
Newsgroups: comp.sys.mac
Subject: Re: Virii at the U of I
Keywords: virus disk insert
Message-ID: <627@ethz.UUCP>
Date: 24 Sep 88 22:49:09 GMT
References: <20200005@uxh.cso.uiuc.edu> <46700066@uxf.cso.uiuc.edu>
Reply-To: macman@ethz.UUCP (Danny Schwendener)
Organization: ETH Zuerich, Switzerland
Lines: 43

In article <46700066@uxf.cso.uiuc.edu> thompson@uxf.cso.uiuc.edu writes:
>
> A program which hooks into the "disk insert" notice in System, like
>Soundmaster does with its sounds, which automatically runs a
>virus-masher over the inserted disk. 

The disk-insert detection isn't difficult to implement. The problem
lies in the User-friendliness and in the program chaining.

First the user-friendliness: Would you be happy if you had to wait for
one or two minutes each time you insert a disk? What if you're working
on single-drive units? Your students will make a sit-in strike if they
have to go through this hassle.

The chaining: The Macintosh OS is just not conceived for passing
parameters on a program startup. The only parameters that you may
pass are one or several documents with the same owner ID and a
flag which determines what the application should do with these
documents (open or print). I don't have IM at hand, so correct me
if I'm wrong. 

But it is possible, nevertheless, assuming that both the Disk-insert
trapper INIT and the virus-tracer are specifically written for each
other. The application would check on startup if any document of
any type has been passed as parameter, and use the document's pathname
as information about the volume to check. The INIT would have to
trap a disk-insert interrupt and start the tracer program with
any file (e.g. the desktop file, which is on all disks) as parameter.

Hmm wait... I think there's an additional problem with this. If the
disk insertion is trapped *before* the disk is normally mounted
by the OS, there is no way to give any document of that disk as
parameter. Could anyone check what comes first? Logically, it would
be the interrupt, and in this case, you could forget about the idea.

-- Danny

+-----------------------------------------------------------------------+
| Mail   :   Danny Schwendener, ETH Macintosh Support Center            |
|            Swiss Federal Institute of Technology, CH-8092 Zuerich     |
| Bitnet :   macman@czheth5a      UUCP   :   {cernvax,mcvax}ethz!macman |
| Ean    :   macman@ifi.ethz.ch   Voice  :   yodel three times          |
+-----------------------------------------------------------------------+