Path: utzoo!utgpu!news-server.csri.toronto.edu!cs.utexas.edu!usc!julius.cs.uiuc.edu!zaphod.mps.ohio-state.edu!unix.cis.pitt.edu!dsinc!netnews.upenn.edu!vax1.cc.lehigh.edu!cert.sei.cmu.edu!krvw
From: woody@chinacat.Unicom.COM (Woody Baker @ Eagle Signal)
Newsgroups: comp.virus
Subject: Re: Is this a virus? Help! (PC)
Message-ID: <0009.9011201348.AA00696@ubu.cert.sei.cmu.edu>
Date: 20 Nov 90 05:17:04 GMT
Sender: Virus Discussion List <VIRUS-L@LEHIIBM1>
Lines: 16
Approved: krvw@sei.cmu.edu

rem@cs.bu.edu (Robert E. Mee) writes:
> I recently noticed what seems to be a trojan on my PC. I notice two
> files in my root directories (c and d) they have eight character
> filenames (ex: 111E340A and 111E340F).  They are only displayed when I
> type "dir | more" in my root directory. The file names change (as well

Dos fakes redirection pipes by creating a temporary file on the disk,
and writing to it.  Newer versions of dos have a function to make a
temporary file.  It is created from the time and date stamp, and is a
hex number.  When you do a dir | more, Dos creates a scratch file to
put the output of dir into.  More then takes that, and apparently uses
a scratch file or perhaps Dos creates 2 scratch files.  In any case,
it is a standard feature of DOS, and not to worry.

Cheers
Woody