I am NOT looking for your favorite laundry list of links
to generic anti-virus or anti-spyware tools on this one.
Also, I already know that Windows 98 is inherently
unstable, so I don't need more remarks about that.
If this is a virus, it has haunted me for 4 years,
-- slow growing, like AIDS...
Somewhere "back then", I had noticed additional
folder directories and file duplications and had deleted
them.
As a side comment on another recent problem related
to the HOSTS file and the CLOCK, I found a strange
file in my folder of personal batch files, which I call
C:\SYS\CMDS\BAT
This file was called WINDOWS, and it had no extension
and its size was indicated as 0. When I looked at it
with Quick View Plus, it showed a single sub-entry
called Untitled0, but I did not risk extracting it with the
unzip feature that is available with Quick View Plus.
When I deleted this mess and eventually restored it,
It now showed a monstrous floating point size, which
I certainly did not want to risk extracting.
Once in awhile during a crash recovery, Norton Disk
Doctor picks up and saves lost clusters. Sometimes
it is in readable ASCII format, sometimes not. This
morning I had a hunch and looked at it with Quick
View Plus. Most of it was unreadable, but it started
off with GIF89.
Using the FIND command I found a folder with a
large number of GIF files, with enormously long
numeric names. Clicking on one did show any
image.
This folder was called C:\DIGITAL\MEMORY and
C:\DIGITAL itself was one I had saved from the
Net back in 2001, because it had the user manual
for my older Digital Starion computer.
You may have noticed that when you save an HTML
file from the Net, your system creates an additional
folder containing the GIF or other files called by that
HTML document. This MEMORY folder was like that.
But, when I clicked on it, I found a repeat of what
I had just looked at, and so on, nested down to
infinity.
I used an EXIT TO DOS and looked at it closer.
It was nothing but a RECURSIVE LINK, with a
LNK extension.
I deleted all those phony GIF files. The only
other clue I have is a file called 000000FX.EXE which
can't be identified with PROPERTIES and has none
of the usual heading information. Also, it is short,
or at least what I can see with Quick View Plus is
short. Since it has the same date as I downloaded
the original Digital stuff, it was either brought in
as a virus then, or its date was spoofed later.
There are a number of VERY good files related to
memory utilization here. I must have saved an
HTML file called MEMORY, but I don't remember now.
I have never seen anything like this recursive link
before, but my guess is that it was caused by some
sort of malware.
Any ideas?
