[comp.virus] Checking during Desktop Rebuild

XRJDM@SCFVM.BITNET (Joe McMahon) (10/19/90)

John Costello asks about Virex's automatic checking when Norton
Utilities is rebuilding the Desktop. Virex (and SAM, and other
anti-WDEF programs) hook the OpenResFile trap and look for the
Desktop file being opened (which, obviously, it is when it is
being created). These programs can then look for "implied
loader" viruses before the application has a chance to make a
call that might wake them up - opening the Desktop adds the
Desktop to the top of the current resource search order, where
bogus,  viral executable resources could override the desired ones.

 --- Joe M.