Path: utzoo!utgpu!water!watmath!clyde!att!osu-cis!tut.cis.ohio-state.edu!mailrus!ames!amdcad!sun!pitstop!sundc!seismo!uunet!mcvax!cernvax!ethz!macman From: macman@ethz.UUCP (Danny Schwendener) Newsgroups: comp.sys.mac Subject: Re: Virii at the U of I Keywords: virus disk insert Message-ID: <627@ethz.UUCP> Date: 24 Sep 88 22:49:09 GMT References: <20200005@uxh.cso.uiuc.edu> <46700066@uxf.cso.uiuc.edu> Reply-To: macman@ethz.UUCP (Danny Schwendener) Organization: ETH Zuerich, Switzerland Lines: 43 In article <46700066@uxf.cso.uiuc.edu> thompson@uxf.cso.uiuc.edu writes: > > A program which hooks into the "disk insert" notice in System, like >Soundmaster does with its sounds, which automatically runs a >virus-masher over the inserted disk. The disk-insert detection isn't difficult to implement. The problem lies in the User-friendliness and in the program chaining. First the user-friendliness: Would you be happy if you had to wait for one or two minutes each time you insert a disk? What if you're working on single-drive units? Your students will make a sit-in strike if they have to go through this hassle. The chaining: The Macintosh OS is just not conceived for passing parameters on a program startup. The only parameters that you may pass are one or several documents with the same owner ID and a flag which determines what the application should do with these documents (open or print). I don't have IM at hand, so correct me if I'm wrong. But it is possible, nevertheless, assuming that both the Disk-insert trapper INIT and the virus-tracer are specifically written for each other. The application would check on startup if any document of any type has been passed as parameter, and use the document's pathname as information about the volume to check. The INIT would have to trap a disk-insert interrupt and start the tracer program with any file (e.g. the desktop file, which is on all disks) as parameter. Hmm wait... I think there's an additional problem with this. If the disk insertion is trapped *before* the disk is normally mounted by the OS, there is no way to give any document of that disk as parameter. Could anyone check what comes first? Logically, it would be the interrupt, and in this case, you could forget about the idea. -- Danny +-----------------------------------------------------------------------+ | Mail : Danny Schwendener, ETH Macintosh Support Center | | Swiss Federal Institute of Technology, CH-8092 Zuerich | | Bitnet : macman@czheth5a UUCP : {cernvax,mcvax}ethz!macman | | Ean : macman@ifi.ethz.ch Voice : yodel three times | +-----------------------------------------------------------------------+