XRJDM@SCFVM.BITNET (Joe McMahon) (10/19/90)
John Costello asks about Virex's automatic checking when Norton Utilities is rebuilding the Desktop. Virex (and SAM, and other anti-WDEF programs) hook the OpenResFile trap and look for the Desktop file being opened (which, obviously, it is when it is being created). These programs can then look for "implied loader" viruses before the application has a chance to make a call that might wake them up - opening the Desktop adds the Desktop to the top of the current resource search order, where bogus, viral executable resources could override the desired ones. --- Joe M.