rreiner@nexus.yorku.ca (Richard Reiner) (03/20/91)
A mighty strange thing happened on one our departmental PCs today. I had just finished using the machine, in the process noting that the new screen saver I had installed a few days ago was working well. I moved to another machine in the room, and someone else sat down to work at the PC in question. Within minutes, she was complaining about a misbehaving screen saver that would not go away. But it was *not* the same screen saver I had seen working -- it was an old one we had removed from autoexec.bat a week before. All this woman had done was to reboot the machine and then start a comms program -- nothing she had done should have altered autoexec.bat in any way, but when I inspected autoexec.bat, its contents were those of a week ago! I had booted the machine a short time earlier, and the current autoexec had run, as evidenced by the presence of the new screen saver. So something replaced autoexec.bat with an old copy of it in the interim between my booting the machine and her booting the machine. I am at a loss to explain this. Is there a known virus or trojan which tampers with autoexec.bat like this? //Richard