Path: utzoo!utgpu!jarvis.csri.toronto.edu!mailrus!csd4.milw.wisc.edu!lll-winken!uunet!mcvax!hp4nl!dutrun!vlruo02
From: vlruo02@dutrun.UUCP (Ge van Geldorp)
Newsgroups: comp.sys.ibm.pc
Subject: Re: New? Virus
Summary: No virus
Keywords: Microsoft editor
Message-ID: <676@dutrun.UUCP>
Date: 28 Mar 89 21:42:18 GMT
References: <11758@louie.udel.EDU>
Reply-To: vlruo02@dutrun.UUCP (G.v.Geldorp)
Organization: Delft University of Technology, The Netherlands
Lines: 16

In article <11758@louie.udel.EDU> davis@udel.EDU (Michael Davis) writes:
>Has anyone ran across a "virus" that consists of a hidden dir called INDEX
>that has subdirectories named DELETED containing still, files call
>DELETED.xxx where xxx are hex numbers?  When the files are deleted,
>a new DELETED subdir is created with more files!!! It's happening on
>my prof's machine at home

Sounds like your prof is using the Microsoft Editor (M.EXE). In the
default configuration, this editor will save backup copies of the files
edited in a hidden subdirectory named DELETED. The INDEX you mention is
not a subdirectory but a file in the hidden subdirectory DELETED.
If you want to get rid of the files in the DELETED subdirectory use the
EXP.EXE program which comes with the Microsoft Editor.

Ge van Geldorp.
(...uunet!mcvax!hp4nl!dutrun!vlruo02)