Path: utzoo!utgpu!jarvis.csri.toronto.edu!mailrus!tut.cis.ohio-state.edu!ucbvax!decwrl!pyramid!prls!philabs!linus!mbunix!jcmorris
From: jcmorris@mbunix.mitre.org (Joseph C. Morris)
Newsgroups: comp.sys.ibm.pc
Subject: Re: New? Virus
Summary: They might be legitimate
Message-ID: <47106@linus.UUCP>
Date: 30 Mar 89 21:45:29 GMT
References: <11758@louie.udel.EDU>
Sender: news@linus.UUCP
Reply-To: jcmorris@mbunix (Morris)
Organization: The MITRE Corporation, McLean, VA.
Lines: 11

In article <11758@louie.udel.EDU> davis@udel.EDU (Michael Davis) writes:
>Has anyone ran across a "virus" that consists of a hidden dir called INDEX
>that has subdirectories named DELETED containing still, files call
>DELETED.xxx where xxx are hex numbers?  

Are you sure that the machine doesn't have one of these TSR's which 
protects you from accidentally deleting a file?  What they do is to
save the "deleted" file for _n_ days, usually in a hidden directory.
If you accidentally delete a file, it can recover it by un-renaming 
the original file.  Check the AUTOEXEC.BAT and maybe CONFIG.SYS for
an invocation of some such program.  Good luck.