Hello everyone, today we're gonna be taking a look at the "Sov" DOS virus.
Before we get into that.
I just wanna take a moment to highlight this...
...amazing meme submitted to me today by @YoshiFan13 on Twitter.
Because, just look at it.
It's amazing, and it accurately sums up everything that happens in these DOS videos.
And it's about to happen again today
I'm taking a look at Sov because I get a lot of comments that talk about how much more fun malware was back in the 80s and 90s, as opposed to nowadays.
Where most of it is silent, stealthy and...
...tries to steal your credit card number.
Or, show you ads.
They always mention that back in the day, viruses got in your face,
Were rude, crude, and vile.
And they basically try to beat you up for your lunch money.
And Sov is about as "in-your-face" as it can get.
So we got 2 variants here,
they're both very similar. The only thing
that changes is the payload text. and so
1193 is the first variant we'll take a look at.
It's 1193 because it is 1193 bytes long. We've
gone and executed it will now infect
every .COM file we run. So what do we do?
We look at our old pal graphics.com and
of course it is nineteen thousand seven
forty two bytes and we are going to
infect it by running. If we look at it again,
oh it's 20,000,937 bytes because it got
infected and so activates on the
February 23rd of every year as well as
many other dates that are all old Soviet
holidays but February 23rd is the
one I remember so it's the one we're going
with. And any time we run any infected
file on this date we get a big screen of
grey bars it kind of looks light on the
camera these are gray and hit enter and
it runs your program trying to run
anything like edit will affect the file
and show you the screen but you just hit
enter and it eventually launches the
program you want. Change the date back
real quick and we'll see the same thing
here with the other variant which is
1205 (twelve hundred and five) bytes long and
this is where the virus really gets in
your face
when you have this virus you pretty much
know you're infected with the virus so
we're going to get sys.com (I cannot type)
which is regularly 9432 bytes. we run
it it get infected by one of the two I'm
not sure which one is going to affect it
but it does grow to 10,633 and
we will go ahead and change the date
back. We should hopefully see - not the bars,
No! okay that virus has to get out of
here now we're just going to run Sov
directly here There we go. So instead of the
bars, you get a giant screen and all it
says is "I AM VIRUS". Now I'm not an
expert I don't know much but if I saw
this screen when I was attempting to do
some some some form of work I would
probably start thinking that I was
infected with something but once again
you can enter, it goes away and you are
free to use your computer as normal.
What happens if we run VSafe, the antivirus?
We get the bars and VSafe
is installed i'm sure it'll try to stop
us from infecting stuff like doskey. It's
gonna say it's trying to write to it no
wow VSafe is worthless but anyway that
is about it for Sov. There's not too much
more to show you I just want to end the
video on the giant I'm oh god what
happened okay VSafe found this in that
one but not when it infected the other
one and scared the crap out of me too
well alright that's definitely one way to
end the video. That is about it for the
Sov DOS virus. VSafe detects it,
but only when it's not infecting files
basically you have to be thoroughly
infected before VSafe will do anything
for you which is always good so that's
it thanks for watching thanks YoshiFan13
for this amazing meme and
that's it. Take care.