From: "Mark Rosen" <mrosen@peganet.com>
Date: Wed, 18 Dec 1996 14:50:11 -0800 (PST)
To: "Vincent Padua" <cypherpunks@toad.com>
Subject: Re: The virus I got...
Message-ID: <199612182245.RAA07424@mercury.peganet.com>
MIME-Version: 1.0
Content-Type: text/plain


> There was an e-mail sent to the list that had attached to it a virus. 
Well
> lucky me I got.  It was a .com file that apparently turns your files into
> directories.  I can't boot into Win95 since it turned my HIMEM.SYS into a
> directory.  So, I seem to have fixed that, but now it says "access
denied"
> and then prompts me with C:\>.  Did anyone else get it?  Has anyone heard
> or fixed this virus?
	Yes. FIrst of all, NEVER run any executable you recieve that is just
attached to an e-mail message like that. Unfortunately, my stupid trackpad
on my laptop slipped and I too ran the file. Your registry has been deleted
and it looks like every file that was not hidden in the Windows directory
(or at least a lot of them) have been renamed and made directories. I
suspect the file information still exists but is messed up. You probably
won't ever be able to get it back. First you need to remove all of the
rogue directories (type dir /w/o/p at c:\windows\ and then rmdir everything
in brackets that looks like it was a file - it'll have a '.' in its name).
You can then reinstall Windows 95. All of your configuration will be lost,
but at least you're up again. I'm posting this to the list if anyone else
has also run this program, but if anyone has any more questions, please
e-mail mrosen@peganet.com.
	Did anyone find out a real e-mail address from this guy. I'd like to
uhhh... cyberbeat him. Oh, and as far as I know, no virus was installed,
though you should check for one just for good measure.

Mark Rosen
FireSoft - http://www.geocities.com/SiliconValley/Pines/2690
Mark Eats AOL - http://www.geocities.com/TimesSquare/6660