Peter Ferrie
Virus Bulletin, June 2002, pp.4-5
ISSN 0956-9979
June 2002
Download PDF (38.93Kb) (You need to be registered on forum)In early 2000, while studying the latest release of the Portable Executable format documentation from Microsoft, I noticed the word `callback' in a section describing data initialization. The section was called `Thread Local Storage (TLS)'; in previous revisions of the documentation I had disregarded it, considering it uninteresting, but this time it had my full attention.
Where there are callbacks, there is executable code and where there is executable code, there may be viruses. However, it was a further two years before the appearance, in 2002, of the first virus that is aware of Thread Local Storage: W32/Chiton.