mirror of
https://github.com/opsxcq/mirror-textfiles.com.git
synced 2025-08-12 21:44:32 +02:00
23 lines
1.6 KiB
Plaintext
23 lines
1.6 KiB
Plaintext
|
|
Ä Area: Virus ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
|
|
Msg#: 16171 Rec'd Date: 02-12-95 08:36
|
|
From: Jim Gex Read: Yes Replied: No
|
|
To: Sysop Mark:
|
|
Subj: 8 CHARACTER "VIRUS"
|
|
ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
|
|
About a month ago, I called your tech support regarding a suspected virus that
|
|
we had experienced on our machines in addtion to infection with NYB, Form_A and
|
|
Stealth_C. This one appeared to be visible only with the dir/a command, and
|
|
changed (apparently mutated) with each successive dir command. The date was
|
|
current date, but the time appeared to be 1 to 3 minutes in the future. When
|
|
viewed with Norton Utilities, the first character was a small letter sigma
|
|
indicating a deleted file. One could undelete one of the two paired 8
|
|
character files with the undelete command, but not the other. In addition, the
|
|
undeleted file was a directory listing. After a bit of effort, we tracked
|
|
this down as a missing temp directory, and a use of the dos |more command.
|
|
Apparently the more command creates a temp file listing (hidden) which would
|
|
normally go into the temp directory (if exists), absent the temp directory it
|
|
pops up (still hidden) in the directory one asks for a dir (or any other valid
|
|
command) with the more pipe. I'm forwarding this to you just in case your
|
|
tech support has never seen this and suspected a new virus. Thanx, Jim Gex
|