Path: utzoo!utgpu!jarvis.csri.toronto.edu!mailrus!tut.cis.ohio-state.edu!osu-cis!sppy00!wjc
From: wjc@sppy00.UUCP (William J. Curry)
Newsgroups: comp.sys.ibm.pc
Subject: Re: New? Virus
Keywords: Microsoft utilities, Watcom
Message-ID: <228@sppy00.UUCP>
Date: 29 Mar 89 17:57:55 GMT
References: <11758@louie.udel.EDU> <676@dutrun.UUCP>
Reply-To: wjc@sppy00.UUCP (William J. Curry)
Organization: Online Computer Library Center, Dublin, Ohio.
Lines: 30

In article <676@dutrun.UUCP> vlruo02@dutrun.UUCP (G.v.Geldorp) writes:
>In article <11758@louie.udel.EDU> davis@udel.EDU (Michael Davis) writes:
>>Has anyone ran across a "virus" that consists of a hidden dir called INDEX
>>that has subdirectories named DELETED containing still, files call
>>DELETED.xxx where xxx are hex numbers? ... 
>
>Sounds like your prof is using the Microsoft Editor (M.EXE). ... 
>... this editor will save backup copies of the files edited in a hidden
>subdirectory named DELETED. The INDEX you mention is not a subdirectory
>but a file in the hidden subdirectory DELETED.
>If you want to get rid of the files in the DELETED subdirectory use the
>EXP.EXE program which comes with the Microsoft Editor.
>...

In addition, the Microsoft editor comes with a program RM.EXE which, if
mistakenly used instead of the MKS RM.EXE (or others), will also create
a hidden directory called DELETED with these files.  In addition, I seem
to recall that the Watcom C Compiler does something similar to this.  I 
do not use the Watcom compiler, though, so I am not sure on this.
Maybe someone who uses the Watcom compiler could respond on this issue.

Hope it helps!

-Bill

-- 
William Curry 	UUCP:wjc@sppy00.UUCP, or {seismo|cbosgd}!osu-cis!sppy00!wjc
		bitnet:  wjc@oclcrsun
OCLC = Online Computer Library Center                "Services for Libraries"
Snail: 6565 Frantz Road  Dublin, Ohio 43017-0702                614-761-5031