Path: utzoo!attcan!utgpu!jarvis.csri.toronto.edu!mailrus!uwm.edu!uakari.primate.wisc.edu!gem.mps.ohio-state.edu!usc!ucla-cs!uci-ics!orion.oac.uci.edu!manderse
From: manderse@orion.oac.uci.edu (Mark Andersen)
Newsgroups: comp.sys.ibm.pc
Subject: FFC48.ARC - causes problems (for me)
Message-ID: <3415@orion.cf.uci.edu>
Date: 10 Oct 89 00:19:49 GMT
Reply-To: manderse@orion.oac.uci.edu (Mark Andersen)
Distribution: na
Organization: University of California, Irvine
Lines: 32

I just had a very disturbing experience. 
I downloaded the file ffc48.arc from the directory pd1:<msdos.calculator>
on simtel20, put it into a directory by itself on my hard disk, and 
unarchived it. I RTFM'd, then ran the program ffc48-en.com. This program
claims to be a TSR four-function calculator, which sounded very useful to 
me. Anyway, after doing some testing of the program, I exited, and found
a spurious directory entry in the subdirectory which should have contained
only ffc48.arc and the files extracted from it. The directory entry was
for a file called "LUME IN D", size of 1867xxxxx bytes (that's right, 
>186 MB on a 32-meg partition of a 150-meg disk), date-time of 9-00-86
4:01p. This directory is on the fourth (f:) partition of my disk; I checked
the boot (c:) partition and found spurious entries there as well, some for 
files and some for subdirectories. These spurious directory entries appeared
only sporadically; I could type in "dir" a number of times, and see the
spurious entries only part of the time.
After a warm boot about 45 minutes ago, the problem has not reappeared. 
However, I have removed ffc48.arc, etc. from my disk, as well as another
archive file (also from pd1:<msdos.calculator>) by the same author.
Can someone tell me whether I have been terminally stupid, and now have
a virus-infected hard disk? If this is not a virus or Trojan of some sort,
what is it? Presumably Keith Petersen has the answer (I would have just
sent email to Petersen, but I don't have his address handy).
FYI, my system setup is as follows:
Compaq Deskpro 386 (16 MHz), EGA & color monitor, type 25 (150 MB) hard
disk,  3 MB RAM.
MuSh-DOS 3.20, Command Plus v3.0 in lieu of command.com, 386max.
By the way, the program ffc48-en.com had been loaded in high DOS memory
using 386max's loadhigh command.


Mark Andersen                   manderse@orion.cf.uci.edu
Dept. of Ecology and Evolutionary Biology
UC Irvine, Irvine, CA, 92717