Hello, everyone. Today we're taking a look at the MonteCarlo DOS virus,
and this virus is actually the successor to the Casino DOS virus.
They're both pretty similar, but we'll go ahead and take a look at this.
So, once the virus is present in memory, it will infect .exe files, actually.
It does not go after .com files.
So we'll look at Power.exe.
We'll see that its normal size is 8,052 bytes.
When we run the file, MonteCarlo infects it. You can see the file size increases to 9,547 bytes,
so now whenever you run this file, MonteCarlo will also be present, and will run along with it and infect new files.
Now, I actually don't know how exactly this virus decides to activate, but I found, when you change the date
to April 15th at some point in the future, it eventually ends up working.
So we're gonna go ahead and restart here, and get the virus to activate.
Okay, we're booted back into DOS, and I'm just gonna run this file until it activates. That's how I got it to work before.
There we go!
So... it kinda skipped over the first part of the screen...
but it basically tells you that your hard drive has been destroyed, and its copy has been uploaded into RAM,
and if you reset your computer, basically you'll lose all your data, so you have to beat it in a card game,
so this is basically kinda like war, where just... you're trying to one-up the other person.
So... go ahead and hit enter...
So we have our representations of cards. See, I lost.
You can increase your bet. I'm not really sure what I'm doing,
so, we'll just kinda mess around with it.
I lost.
I won.
I won again.
Alright, we're just gonna bet it all. Go big or go home, right? Big win Dan.
Big win Dan. Alright, it takes a little while... to, uh...
get up here to the max bid...
Come on.
We're gettin' there. We're almost there. We're almost ready for the big win Dan.
Alright, and... Go! Aww... man, I lost.
And the hard drive light is going crazy.
That's probably not a good sign.
Uh-oh.
Um, let's just sit here and we'll see what happens. Maybe it's getting my data back... Oh no.
Okay, the computer restarted...
This could be... good or bad.
Still booting.
Seek test works fine.
But, it would appear that all of my data is actually gone, because we're not booting from the hard drive, which is bad.
Let's try booting from a floppy disk; we'll see if there's anything actually left on the drive.
Alright, we have booted from our floppy disk.
And... Let's check out the C drive.
Our files are still there!
That is surprising.
Why can't we boot from the drive?
Oh, that's probably why.
Well, um...
Some of our files have been changed into oddly named directories.
Like [ t t Q Q . Q]. Let's try changing to one of those.
CD... I don't know how to change directory to a drive... er, a folder starting with a space, so this might be kinda tricky.
Uh... it tried, but it did not work.
So, it would seem that our DOS install is... pretty trashed.
Reinstalling might actually save your data, but if you had some important data wherever this virus decided to overwrite, you would probably lose it, so, it's pretty damaging.
Uh, pretty confusing, especially since I don't understand the language that the virus tells you the instructions in.
And pretty destructive as you've seen.
And that's really about it for the MonteCarlo DOS virus. Thank you for watching.
So I decided to just run the virus a bunch of times again.
And this time I did not end up hitting an extra key, so I did not skip over the instructions that basically tell you,
"Caution, your hard drive has been overwritten and put into RAM, and if you restart now, you'll basically lose everything."
So... just a quick addendum here. And now that is REALLY about it for the MonteCarlo DOS virus. Thank you for watching.