Hello everyone today we're taking a look at the "Vanish" MS-DOS virus.
This virus, instead of infecting both .com and .exe files, actually only infects .exe
So, we'll go ahead and run it really quick.
And upon running the executable, we are greeted with a message that tells us the usage for 'pkzip'
You might be wondering why you would have that, well this virus has actually infected this copy of pkzip.
Say maybe you downloaded your own copy of pkzip from a pirate bbs board,
and you're excited to use it - but what you don't know is that it comes bundled with a virus.
So, we'll go ahead and exit out of this because we don't actually need to zip up or unzip any files.
We are going to go ahead and change directories now and look at it infecting files.
One file we're going to infect is called 'power'.
Let's go ahead and run it.
The original size is eight thousand fifty two (8052) bytes
After it's executed, vanish has taken effect and actually infected this file
And you can see the file size has grow to nine thousand eight thirty nine (9839) bytes.
Similar things can be seen with other .exes
So, undelete is twenty six thousand four sixteen (26416)
run it again
We'll run it for the first time, rather.
... and it grows to twenty eight thousand one ninety nine (28199).
Now, this in of itself isn't that bad. However the virus activates on the 5th of any month - when that day is a Sunday.
So, Sunday the 5th
We'll change the date to March 5th, 1995, which is a Sunday.
... and we're going to go ahead and run any infected exe.
Actually, first let's print out a dos prompt so we have a nice character background here,
and now we'll run an exectuable.
... and instead of our executable running
Vanish proceeds to tick down every character in the ASCII table character set
So it's backing its way towards the space or blank ASCII character which will effectively blank out the screen.
I'm going to go ahead and speed this up because this is pretty slow and see how it ends up blanking out the screen
And there we go, the virus has finished scrolling through all the lines of text and basically turning all the characters into blank spaces
And, we actually cannot do anything
The computer is frozen, as you can hear it's not liking me typing on the keyboard because it's not accepting input.
We will go ahead and restart really quick
However, restarting doesn't do much good as long as the day's on Sunday the 5th, this is going to keep happening.
So, we'll boot and see this virus take hold again.
For those of you who might be new to the channel, that noise is actually the floppy drive seek test on this Packard Bell 386 Computer
It's a common question I get, usually on these videos.
Gone ahead and booted into DOS. Try running one of our files again.
We'll do another directory listing so it's nice and pretty.
But again, any infected file will just cause this same payload to happen
Basically work becomes pretty much impossible on Sunday the 5th
That's about it. It's not destructive, it doesn't overwrite you data - it just annoys you on certain obscure days of the month.
or of the year, rather
... And, that is about it
Thank you for watching.