Hello everyone,
today we're taking a look at the Datacrime DOS virus.
This virus surfaced in March of 1989 and quickly became a source of panic for many personal computer owners,
partly fueled by media reports like this one:
[news anchor with fabulous 80s hair] Well it is Friday the 13th, and for the superstitious that's a bad luck day,
for computer owners, this time around, it was an ominous day.
This is the day that "Computer Virus" was supposed to attack. Joe McMahan has more on that story.
[Joe, in 80s reporter voice] It's called "Datacrime 2," and it's a virus that has owners of IBM personal computers worried
it might send their PCs to sick beds. An electronic virus is information or instructions added on to a legitimate
computer software program by hackers. Most commonly the virus will wipe out instructions or information stored on that computer disk.
We're told spreading the virus is easy. It happens when people share their computer programs, oftentimes over telephone lines.
[back to regular boring Dan voice] Sounds pretty scary, doesn't it? I know I wouldn't want my computer to be corrupted
by some some mysterious virus...that some guy is just...[loud type type type] typing this.
[loudly and mockingly hitting keys] And then he's hitting F3 and enter. Did you notice that in the news report? Cuz that's my favorite part.
[stunned silence at stupidity of news footage]
So...that is about it for the Datacrime DOS virus, right?
All we have to do is type the name in an invalid format for DOS and hit enter a bunch of times, and we're good.
[easiest virus demonstration ever]
Well at least it qualifies for good footage for the news.
But how about we get to the real virus?
Real quick, before we demonstrate it we must always look at GRAPHICS.COM.
[graphically hits ENTER] Its uninfected length is nineteen thousand, seven hundred and forty two bytes.
And when Datacrime infects it, it will grow and we will see this file size increase.
Because Datacrime will infect GRAPHICS and insert its code into the file itself.
So let's go ahead and run it.
[presses ENTER viral-ly]
And we don't see anything happen, and this virus is not a memory resident virus.
And what that means is when you run it, it does not insert itself into memory to then intercept whatever other programs you may run.
This one is called a "Direct Action Infector,"
which means that every time you run an infected file, it finds one more uninfected file, and infects it.
So this virus only spreads one file at a time when you run an infected file.
And I don't think that first one was enough to get GRAPHICS.COM infected. [typing to check] Nope!
So we're going to run Datacrime *properly* a few times in a row.
We're not just typing "Datacrime II" and hitting enter a whole bunch, fearmongering for the media.
[keys click, hard drive chirps, and the computer becomes a virus factory]
Alright, so that should have infected quite a few files in this directory.
And the way Datacrime looks for files is - first hits drive C, then drive D, and then A and B, your two floppy drives.
But in this case we're just gonna stick to the DOS directory.
[wonderful typing audio]
Have we been infected yet? We sure have, we can see that GRAPHICS.COM
is now twenty thousand, nine hundred and ten bytes because Datacrime has infected it.
And what was so scary about Datacrime that it had computer owners freaking out?
Well, starting on October 13th, 1989, and later, which that year happened to be Friday the 13th, of course,
Datacrime formats the first nine tracks of your hard disk, which would overwrite the boot sector, the first File Allocation Table [FAT] and most of the second,
pretty much causing all of your files to be inaccessible and pretty costly to recover without specialized tools.
So we're going to change the date [type type type] to October 13th, 1989.
We can see here it is indeed Friday the 13th, which is always spooky and makes for good news stories.
[ENTER pressed loudly] And we're going to run GRAPHICS which we know is infected.
[ENTER, followed by soulless PC speaker beeping]
[beeping continues under Dan] So we see "DATACRIME VIRUS, RELEASED: 1 MARCH 1989,"
[beeping painfully continues] and a relentless series of beeps from the PC speaker.
[BEEP BEEP BEEP BEEP]
[beep forever] So it sounds to me like our system is probably trashed, but let's go ahead and restart and see for real.
[ctrl+alt+del pressed, making beeping mercifully stop]
Enjoy the seek test. [and the silence]
[3.5" A drive Brrrr brrrr]
[5.25" B drive BRRRR BRRRR]
[happy POST beep, followed by A drive CHRK to check for disk]
[hard drive chirps softly to itself while it loads DOS]
Looks to me like we got our data back just fine.
As it turns out, all this hype and fear and panic over Datacrime
was unfounded because there's a bug in the format routine.
Datacrime fails to format your drive and instead just kinda scares you with the message and beeping, and when you restart everything is fine.
[doesn't anybody test this crap?]
But I've got something for you. [authoritative ENTER press]
I've copied over DATACRIME II.
You might recall the news report mentioning Datacrime II being the virus to be afraid of.
Well this is a new and improved version of Datacrime that fixes that bug and actually successfully formats your hard drive.
But you know what the big issue is about these small variants of existing viruses?
They rarely ever spread more than the first variant.
But at least we can see the payload.
[clack clack type type]
So it runs just the same as the earlier version of Datacrime.
This one probably came from a security researcher and that's why it tells us "This is an infected EXE program."
But as it turns out, this is actually an infected COM file.
But we're not gonna worry about the differences between EXE and COM files right now, we're looking at Datacrime!
[sarcastically] The most terrible virus ever seen in history.
It infects files in the same exact way as the first Datacrime, it's a direct action infector,
so we're gonna skip right ahead to the payload part.
Back to Friday the 13th,
[type type type] and here we go.
[ENTER followed by five BEEPs]
So this one says "DATACRIME II VIRUS," beeps five times, and then nothin'.
And let's restart once more with this.
[ctrl+alt+del pressed]
[hope you have been enjoying this video!]
[A drive Brrrr brrrr]
[B drive BRRRR BRRR]
[happy POST beep but then]
[alarming BEEP BEEP]
So there we can see Datacrime II has successfully formatted the first nine tracks on the hard drive,
leading us to be unable to boot.
So just how damaging was Datacrime and Datacrime II?
Well according to this Associated Press news report from September 19th, 1989,
a security researcher who developed an antivirus called Flu-Shot Plus, Ross Greenberg,
encountered a whopping seven [actually six] total cases of Datacrime infections.
And let's not discount the chairman of the Computer Virus Industry Association of Santa Clara California,
John McAfee,
who himself, (and the entire association), saw a combined...
maybe six cases of Datacrime [actually seven].
So why would a virus with such a low threat potential become such a big deal?
Well partly in [sic] due to scare mongering news reports like we saw before,
and also word of mouth - you see the report on the news, you tell your friends about that deadly new IBM PC virus that's out there.
They tell their friends even though they don't even *own* a computer. Soon everyone knows about this dangerous virus,
but nobody knows what it is, what it does, or how it really works.
You see the same thing time and time again throughout computer virus history,
whether it's the Michelangelo virus or even not a virus like the Y2K transition.
And after all that hype, how did the news report close out their coverage of the Datacrime virus?
[Joe blesses us with his fabulous voice and hair once again] Some computer experts say all of this hype over the Friday the 13th
virus attack is just that - hype. And judging from the small number of PCs that have succumbed to the virus,
they're probably correct. Joe McMahan, Channel 7 Eyewitness News, Los Angeles.
[Dan, with regular hair] Thanks Joe. It would seem that we have...nothing, to worry about.
Well, *I* have something to worry about, my hard drive was one of the combined 13 peoples' who got formatted.
But all in all, Datacrime was not a big deal, it was very far from the computer destroying terrible virus that the media made it out to be.
It ended up having very little impact on personal computer users of the time,
and is just yet another example of the media blowing a computer virus out of proportion.
So that is about it for the Datacrime DOS virus, thank you very much for watching,
take care. :)