Hello everyone, today we're taking a look at the
Obora DOS virus
uh, this virus is actually pretty neat and uses an
interesting way to, sort of slow down its infection
routine
So we'll go ahead and run it the first time
We see, that the sacrificial goat file states that it is a
10,000 byte .exe file,
but if we look at the actual virus itself
it is 11,574 bytes
which gives us a file size increase of
1,574 bytes.
And I mentioned the interesting way it infects
and that's, as you run it,
Obora doesn't always infect things,
until the third time you run it.
[HDD NOISE - WRITING]
So, there you could hear there was a little pause,
and, uh, there was some hard disk activating
[HDD NOISE - WRITING]
and every third time
[HDD NOISE - WRITING]
Obora infects a new file.
[HDD NOISE - WRITING]
In this case this virus only infects .exe files
[HDD NOISE - WRITING]
and picks out a random one and infects it.
[HDD NOISE - WRITING]
So, we'll look at "xcopy"...
So we see that the uninfected size of "xcopy" is
16,930 bytes,
but, if we keep running Obora,
we should eventually see,
[HDD NOISE - WRITING]
That, that file becoms infected.
[HDD NOISE - WRITING]
So we're just gonna do this for a little bit
[HDD NOISE - WRITING]
Enjoy the model M sounds...
[HDD NOISE - WRITING]
We'll look at it again...
Uh, not "xopy"
There we go, we see
that the file size has increased, after Obora has infected it,
to 18,502 bytes.
And, if we run it,
we'll see the same infectious behaviour
every third time you run it.
[HDD NOISE - WRITING]
So there was a little pause before the actual file runs,
and
searches for a new .exe to infect.
[HDD NOISE - WRITING]
Same behaviour.
Now, Obora's first payload activates on
the
Sunday of any month--
probably coulda worded that a little better...
On any Sunday.
So, February 12th 1995
was a Sunday.
If we run the virus, or any infected file,
we should see,
the screen clear itself.
And the computer becomes unusable, and it hooks
the, uh, timer
at the certain times of the day...
...we'll make sure that it's at the right time...
...see if we can get this to pop up,
we might have to restart first...
...before it realizes...
...that the date has changed...
Let's go ahead and restart really quick.
[HDD NOISE - READING]
Alright, we're back in MS-DOS
So we'll go ahead and run it, and we should see...
...the screen get blanked,
as Obora cycles through the timer, and eventually...
turns off the screen, just like that. (wow perfect timing)
And, so, once it does this, you can't use your computer..
Your only option... you can enter...
Commands aren't registering, so your only option is to
restart.
Which we will do now.
Now we will take a look at Obora's second payload, which
is slightly more damaging, but not unrecoverable.
So take note at this bootup sequence...
[SEEK TEST - A:\]
[SEEK TEST - B:\]
So this is our normal boot sequence on this 3-86,
[BEEP - POST COMPLETE]
The seektest is performed on the
two floppy disk drives and the hard drive,
and there's one beep as it passes the post..
and, boots into DOS.
Now, if we switch the date to 22nd of any month..
In this case we'll just use February 22nd.
Any file infected with Obora will now produce this effect:
So we get the flag and we get the flashing message saying:
"MY NAME IS TROUBLE"
"HELLO FROM KETY"
keti?
kitty?
kitti?
I don't know..
"CREATED BY KEVIN"
So, thanks, Kevin, for the Obora DOS virus..
And, after it displays that it will run the file
you were attempting to run.
And also, gives us a really cool cyan DOS prompt
I'm not sure if you can see the color very well,
looks about the same on the video,
but if you flip back and forth between the two sections
it might be a little bit different.
But it is definitelly a light blue color, instead of
the regular gray..
And if we restart, after having this payload occur..
This happens any time you run an
infected file on the 22nd..
We'll notice that the boot sequence has changed..
[SEEK TEST - FAILURE: DRIVE A:\ SIZE NOT SPECIFIED]
[SEEK TEST - FAILURE: DRIVE B:\ SIZE NOT SPECIFIED]
So, different sounds of our drives...
[BEEP]
And we see, that Obora has, uh, tweaked or emptied the
CMOS data,
[BEEP - SETUP STARTED - ERRORS FOUND]
but only a bit of it, So, if we go to the
CMOS, we'll see that we just have to reset the "disk tette,"
DISKETTE types
[MODEL M KEYBOARD CLICKING]
Aaaaand, we'll be good to go.
And, other than that, that is about it for the
Obora DOS virus
Not too damaging, but still pretty annoying..
a couple times every single month.
So, thank you for watching!