SAM Intercept consists of two components: a startup program, called the SAM Intercept INIT and a Control Panel program, the cdev. SAM Intercept INIT watches your system for suspicious activities and intercepts them. The SAM Intercept cdev lets you control how the INIT operates on your Macintosh.

^BSAM Intercept INIT
When a suspicious activity occurs, SAM intercepts it, displays an alert, and waits for you to decide what to do. For example, if the attempt is to launch an infected application, an alert is displayed which allows you to Stop the launch or Proceed with it. In other alerts you can Allow the attempt to take place THIS TIME ONLY, Deny the attempt and thereby stop it THIS TIME ONLY, or instruct SAM Intercept to Learn about the attempt. In the latter case, SAM Intercept records the attempt and the current application in an Exceptions List. If the same attempt occurs again within the same application, SAM allows it without displaying an alert.

^BSAM Intercept cdev
The options in the cdev let you decide how the startup program operates on your Macintosh. The 'Configure' button displays the Configuration Options dialog box where you decide whether or not the SAM Intercept icon appears at startup, choose the Protection level, or choose a Startup Bypass Key. The 'Scan' button displays the Scan Options dialog box where you set SAM Intercept's run-time scanning options, including floppy disk scanning, folder scanning, and scanning at shutdown or startup. The 'Security' button displays the Security Options dialog box where you can lock SAM Intercept or decide how the SAM Intercept alerts function. The 'Exceptions' button displays the SAM Exceptions List, which is updated when you instruct the SAM Intercept INIT to Learn certain activities. In the SAM Exceptions List, you can delete specific entries from the list, clear all entries, or print the List.