Hello everyone, today we're taking a look at "Monday",
an MS-DOS virus that's not very big, its only 499 bytes long for the entire virus.
However, it packs quite a vicious payload, and it could blindside you if you're not ready for it.
So, we're gonna go ahead and run this [keyboard tapping]
Aaaaaaand....
Right now, the virus is totally okay, it infects random files of the ".com" extension
Either in the current directory, or it will search out and find other directories to infect
and then once it's infected everything it can find, it eventually drops down into the root directory
and infects everything in there, such as "command.com"
So we're just gonna go and run this a bunch of times
until we infect our good friend, "graphics.com". [key tapping]
When we look at it, we know, as always
it's 19,742 bytes, however it will not be this size once Monday infects it.
So we're gonna go ahead and run Monday a bunch of times
until eventually it randomly decides to infect "graphics".
[key tapping] [hard disk noise]
Okay, so we ran the virus a few times
[key tapping]
and now, when we look at "graphics.com"
we can see Monday has infected it
and the file size has grown to 20,241 bytes.
Now, Monday is not a very stealthy virus.
Normally, on this channel, we'll see quite a few viruses, worms and other things
that will wait until a certain date to activate.
This ensures that they go undetected, or at least mostly undetected by the user for as long as possible
so they can spread to as many targets as possible.
So when you get stuff like CIH, that only activates on April 26th
or anything else... I can't think of anything off the top of my head that...
that activates on a certain date... That's done for a reason
you know, the date's picked...
for a significant meaning to the author
or maybe it's a holiday, like Christmas or Halloween
Monday... does not do that.
It activates, as you might expect...
every single Monday of every single month.
So that's at least four times a month that this virus could potentially activate.
And when it activates, it's not subtle.
We're gonna go ahead and run the infected file after we change the date to Monday...
March 6th, 1995
But it really doesn't matter what the date actually is
just so long as it's a Monday.
We're gonna go ahead and run an infected file now.
which, instead of just quitting like usual, tells us
"I don't like mondays ..."
And... that's not normal behavior here.
If we go ahead and look at our files
we still have everything, for now...
but we're gonna go ahead and run "graphics" one more time
just to... thoroughly...
mess up the computer...
You can hear the hard drive on the background...
Monday tells us "I don't like mondays ..." again,
and for some reason we're still able to use the computer, which normally does not happen.
But... that's okay. We're just gonna run some other files...
[hard disk noise]
Actually, the computer should freeze...
like right here. We ran "format" and, right now, the computer...
will not respond to any key presses...
[tapping on keys]
I can hit "enter" as long as I want, and eventually it will beep at me.
[tapping on keys]
[BEEEEEEEEP]
Just like that. So the computer is frozen, hanged... however you wanna say it.
It's messed up. So, we gotta restart.
So, "control-alt-delete" [key tap]
And we'll go ahead and boot up the computer...
and see what Monday has actually done to our hard drive.
[floppy disk drive noises]
And... [multiple beeping]
we get our nice two-beep CMOS or two-beep POST warning...
telling us there's no boot sector in the hard disk.
So Monday actually formats, I believe, it's the first hundred tracks of your hard disk...
which overwrites the partition table, master boot record...
pretty much everything you need to actually access your data. So... that's bad.
And, yeah, Monday is pretty destructive.
And as you might guess, it doesn't really have the potential to get very far...
considering it activates every single Monday.
But... I mean...
this might contribute to your case of Monday's... you know...
your get into the office...
suddenly you lose all your important files...
all your work for your client is gone...
your computer is trashed...
maybe you shared files with other networked computers...
in your MS-DOS network and they're all messed up...
they don't boot anymore, because everything's lost...
You're talking about a lot of lost productivity... you know...
and it's just... It's not good.
I can't think of anything to say. It's not good.
So Monday... pretty simple...
but... pretty destructive.
And that's really about it. Thank you for watching.