Hello everyone,
today we're taking a look at the StealthBomber DOS virus.
This virus, as its name suggests, is a stealth virus, so we won't see any file size increases when it infects .COM files.
However, it infects them in such an unstable manner that it's pretty inherently obvious that something's wrong on your PC just as soon as it infects it
So let's get to it! StealthBomber infects not only when you run an executable but also when you do a directory listing.
[frenzied mechanical typing]
So as soon as you're looking at those COM files it infects them.
So we see it's a generic triage goat, so this is some analyst's sacrificial goat file,
they ran it and infected it with the virus and now we have it.
So StealthBomber is present in memory and when we do a directory listing it will infect files, but we're just gonna run GRAPHICS.COM,
which should be 19,742 bytes. Like I said, we won't see it increase, but let's see if it'll infect it.
[good luck, GRAPHICS.COM]
Yeah, looks like it infected it just fine. Uh, how about SYS?
Alright so doing these one at a time seems to be okay. But things get a little bit weird when you start doing directory listings.
[computer whirrs briefly, then thinks better of it and crashes]
So we made it this far and infected probably one or two files, and then that became just too much for it to keep up with
[you hear me pressing buttons, c'mon dood]
[angry beep] And the machine is now frozen and does not want be hitting keys. [BEEEEP]
So let's restart and enjoy the seek test.
[do you prefer Windows or DOS malware? I like 'em all]
[A: drive 3.5" floppy seek test: Brrr brrr]
[B: drive 5.25" floppy seek test: BRRRR BRRRR]
[happy POST beep and A: drive is checked for boot disk]
Alright, so we've reset, I'm back in the DOS directory, and usually by habit as soon as I get in here I do a directory listing,
but this time I think I'm going to do it without the '/w' or 'wide' parameter, so let's see.
Well I guess since StealthBomber is not in memory we are free to do directory listings as we please. They work just fine.
But if we run GRAPHICS, which we know we infected before...
[GRAPHICS quietly runs along with the virus, poor GRAPHICS]
Okay, our system came back, that's good. And now we try a regular directory listing...
[PC clicks through a few files, then fizzles out]
Umm, I know we have more than fourteen files here.
And since we're seeing FORMAT and KEYB.COM in the file list, I'm assuming they've been infected now too.
[mashing keys, followed by BEEP and a sigh]
But it looks like we are frozen again, so let's restart.
Enjoy the second seek test.
[two for one special, how lucky are you???]
[Brrr brrrrr]
[BRRRR BRRRRRR]
[Beeeeep CHRK]
[the hard disk whirrs and chirps as it dutifully loads MS-DOS]
So it looks like StealthBomber has discovered the command interpreter COMMAND.COM and infected it,
which DOS does not like. So we're gonna have to specify 'COMMAND.COM' here. And now since it's infected
StealthBomber will *always* be with us every time we boot the PC.
This virus activates on August 31st, so let's move the date one day forward.
[BEEP BEEP BEEP BEEP]
Where we see right as soon as we change the date
[reading] "I am the Stealth Bomber, I belong to the new generation of computer viruses, like the stealth bomber I go undetected by enemy radar,"
"Do not panic, I am just showing off how easy I can evade your antivirus system. I do no harm."
That's kind of annoying. Real quick, I need to...
[BEEP BEEP BEEP BEEP]
[annoyed sigh] Not show the virus again, I need to put this back in 60 Hz so it's not so painful to look at.
So we're back in DOS, I remember FORMAT doing some weird things when the PC was infected.
[BEEP BEEP BEEP BEEP]
Uh, other than the message - Yeah, we see 'Parse Error 2.' It doesn't always display its message, but I guess StealthBomber is
feeling particularly great today and really feels like displaying its message.
Now I recall one more thing happening with FORMAT, you can actually specify your drive letter...
[BEEP BEEP BEEP BEEP]
[sigh] Okay, thank you StealthBomber.
And it asks you to insert diskette, you hit enter...but FORMAT no longer functions, this is as far as we get.
[futile keyboard sounds]
So... [angry beep] StealthBomber may say that it does no harm, but...
We can clearly see that our [chuckling] machine is almost unusable. Everything breaks.
[no third seek test, sorry. I will understand if you dislike the video now]
Alright, time to get back into the command interpreter. [typing, then enter]
[BEEP BEEP BEEP BEEP]
[mockingly] Yes I know you are the StealthBomber, thank you...
Alright so we're back in 60Hz refresh rate,
[BEEP BEEP BEEP BEEP]
Okay, just changing the directory sometimes is too much for this virus to contain itself.
And I don't know if we can even try to run any more files.
Does SYS still work? Yeah, SYS still works just fine. This is gonna be a dangerous one, you ready?
[BEEP BEEP BEEP BEEP]
Yes I know....oh hey...
So that time it loaded and infected quite a few of them, but we still froze.
So I'd say StealthBomber does quite a bit of harm because everything becomes corrupted in addition to being infected.
Some programs still kind of work, but others like FORMAT like you saw give weird errors and then don't work at all.
So all in all, it's a nice attempt at making a non-destructive virus with a neat message,
but the execution, no pun intended, was a little bit off.
[I am so sorry for that one]
So that is about it for the StealthBomber DOS virus, thank you very much for watching,
take care. :)