Path: utzoo!utgpu!news-server.csri.toronto.edu!cs.utexas.edu!wuarchive!zaphod.mps.ohio-state.edu!unix.cis.pitt.edu!dsinc!netnews.upenn.edu!vax1.cc.lehigh.edu!cert.sei.cmu.edu!krvw From: rem@cs.bu.edu (Robert E. Mee) Newsgroups: comp.virus Subject: Is this a virus? Help! (PC) Message-ID: <0013.9011191418.AA28547@ubu.cert.sei.cmu.edu> Date: 17 Nov 90 15:59:07 GMT Sender: Virus Discussion List Lines: 20 Approved: krvw@sei.cmu.edu I recently noticed what seems to be a trojan on my PC. I notice two files in my root directories (c and d) they have eight character filenames (ex: 111E340A and 111E340F). They are only displayed when I type "dir | more" in my root directory. The file names change (as well as the creation date) every time I iterate the command. The files are 0 length. They do not exist when I try to delete them. I am guessing that they take on their new names after the directory listing is taken. I have tried stripping out autoexec.bat and config.sys to eliminate the possibility that they are some sort of work file created by some memory resident program but they persist. I Have also tried doing a floppy boot (write protected) and attempt to do the directory but no good. I am not a regular reader of comp.virus but I intend to do so more regularly. If you know anything about this syndrome, please help. Post if it's easier but mail if this is something easy to eliminate or just some silly anomaly about DOS. Thanks, Rob Robert Mee ...!harvard!bu-cs!rem rem%bu-cs.csnet@csnet-relay.arpa rem@bu-cs