Viral Rewind: Virus.Win32.Bacros скачать в хорошем качестве

Viral Rewind: Virus.Win32.Bacros

Visit my Linktree to access my socials and other channels: https://linktr.ee/mausolfb ----------------------------------------------------------- . This Viral Rewind is a bit longer since this virus works differently between Windows NT and Windows 9x operating systems. So strap in! Bacros is a 32-bit virus with multiple payloads that behaves slightly different on NT vs 9x systems. It even drops a Microsoft Word macro virus alongside the other malicious things it does. Bacros looks like a standard text document from its icon and even opens a text document with Bacros (or something different depending on the filename). But don't be fooled; it's in actuality an application .EXE file however if you don't disable "hide file extensions" you won't notice this. When run, Bacros drops several files: msdosdrv.exe: dropped to the Windows/WINNT directory mssys.exe & sys.exe: dropped to the Windows/WINNT system directory. Sys.exe is hidden. Bacros then modifies the Windows registry (or in some instances the win.ini file) to have msdosdrv and mssys launch at startup (with command-line switches controlling their operation). Msdosdrv on Win9x systems will drop WordInfo.doc to the Windows and My Doucments directories which contains W97M.Bacros, a Word 97 macro virus. Msdosdrv does not work properly on Windows NT and thus generates an error message; the macro virus is thus not generated on NT systems. Payloads (controlled by date): 1st of any month (NT only): Bacros searches out all .gif image files on the machine and overwrites them with "KUOLE JEHOVA" 2nd of any month: Bacros searches out all .txt text files and creates a companion file of the virus with the same name as the text file. Then it hides the original text file and links it to the Bacros companion executable. 10th, 20th or 30th of any month (9x only): msdosdrv loads "WordInfo.doc" from the Windows directory launching the Bacros macro virus in Word which overwrites the global Word template thereby infecting any new/opened documents with the macro virus. It also uses this to spread via floppies when documents are saved/accessed via floppy disk. December 6th: Bacros replaces the desktop background with that of the Finnish flag as the date corresponds to Finland's Independence Day. December 25th: Bacros deletes all personal files and the majority of system files thus requiring either restoring from backups or a fresh system installation. ------------------------- Like the Facebook page:   / brian.mausolf   Follow me on Twitter:   / mausolfb