Ä Area: Virus ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
  Msg#: 16171           Rec'd                        Date: 02-12-95  08:36
  From: Jim Gex                                      Read: Yes    Replied: No 
    To: Sysop                                        Mark:                     
  Subj: 8 CHARACTER "VIRUS"
ÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄÄ
About a month ago, I called your tech support regarding a suspected virus that
we had experienced on our machines in addtion to infection with NYB, Form_A and
Stealth_C.  This one appeared to be visible only with the dir/a command, and
changed (apparently mutated) with each successive dir command.  The date was
current date, but the time appeared to be 1 to 3 minutes in the future.  When
viewed with Norton Utilities, the first character was a small letter sigma
indicating a deleted file.  One could undelete one of the two paired 8
character files with the undelete command, but not the other.  In addition, the
undeleted file was a directory listing.   After a bit of effort, we tracked
this down as a missing temp directory, and a use of the dos |more command. 
Apparently the more command creates a temp file listing (hidden) which would
normally go into the temp directory (if exists), absent the temp directory it
pops up (still hidden) in the directory one asks for a dir (or any other valid
command) with the more pipe.   I'm forwarding this to you just in case your
tech support has never seen this and suspected a new virus.   Thanx, Jim Gex