Path: utzoo!utgpu!jarvis.csri.toronto.edu!mailrus!shadooby!accuvax.nwu.edu!rufus!len
From: len@rufus. (Len Evens)
Newsgroups: comp.sys.ibm.pc
Subject: Re: New? Virus
Summary: Be careful with rm
Keywords: Microsoft editor
Message-ID: <570@accuvax.nwu.edu.NWU.EDU>
Date: 29 Mar 89 12:38:36 GMT
References: <11758@louie.udel.EDU> <676@dutrun.UUCP>
Sender: news@accuvax.nwu.edu.NWU.EDU
Reply-To: len@rufus (Len Evens)
Organization: Northwestern Univ. Evanston, Il.
Lines: 28

|In article <676@dutrun.UUCP> vlruo02@dutrun.UUCP (G.v.Geldorp) writes:
|>In article <11758@louie.udel.EDU> davis@udel.EDU (Michael Davis) writes:
|>>Has anyone ran across a "virus" that consists of a hidden dir called INDEX
|>
|>Sounds like your prof is using the Microsoft Editor (M.EXE). In the
|>default configuration, this editor will save backup copies of the files
|>edited in a hidden subdirectory named DELETED. The INDEX you mention is
|>not a subdirectory but a file in the hidden subdirectory DELETED.
|>If you want to get rid of the files in the DELETED subdirectory use the
|>EXP.EXE program which comes with the Microsoft Editor.
|>
|>Ge van Geldorp.

I also managed to produce the same collection of hidden directories and
files as an indirect result of installing the Microsoft
C compiler.  I forget exactly what I did,
but somehow a program called rm.exe got on my disk.   This
program saved deleted files by moving them to a hidden directory from
which they could be recovered. I was using a memory resident
shell in which I had defined some common unix equivalents for DOS commands
including `rm' for `del', but the new rm.exe took precedence and I
started filling up my disk with copies of files I thought I had deleted.

Leonard Evens                      len@math.nwu.edu
Department of Mathematics 
Northwestern University
Evanston, IL 60208
312-491-5537