Fandom

Malware Wiki

BackTime

1,319pages on
this wiki
Add New Page
Comments0 Share

Virus.DOS.BackTime is a dangerous memory resident parasitic virus on DOS.

There are 5 variants in 4 versions, represented by the following:

  • Virus.DOS.BackTime.496
  • Virus.DOS.BackTime.512
  • Virus.DOS.BackTime.527
  • Virus.DOS.BackTime.1234

BehaviorEdit

When the virus is loaded into memory, it hooks INT 8 and 21h to infect any DOS executable that is run.

BackTime.496 might not restore the registers when INT 8 is called.

Debugging is required for BackTime.527 for its runtime, otherwise it would print an "S" and exit directly without staying memory resident. BackTime.528 is the bug fixing release.

BackTime.1234 also drops the virus Stoned.Michelangelo to the boot sector when it is run, and the dropped virus consumes 2K of memory.

Memory usageEdit

The following table shows the memory usage of the variants.

Variant Memory usage in bytes
BackTime.496 512
BackTime.512 528
BackTime.527 ?
BackTime.528 544
BackTIme.1234 1,792

PayloadEdit

BackTime.496Edit

This variant does not manifest itself.

BackTime.512Edit

This variant manifests itself on CGA-adapter only, it "shakes" the screen.

BackTime.527 and 528Edit

This virus sets the system timer in back direction, when the INT 8 is called the virus decrements the content of timer counter. At a result the programs that uses the timer characteristics of computer (like a BenchMarks) are hang-up.

The virus does not change the time in CMOS memory, when the computer is rebooted, the time would return normal, if the virus is not loaded.

BackTime.1234Edit

This variant does not manifest itself, while the dropped virus does on March 6th.

VariantsEdit

This family has 5 variants in total:

  • Virus.DOS.BackTime.496
  • Virus.DOS.BackTime.512
  • Virus.DOS.BackTime.527
  • Virus.DOS.BackTime.528
  • Virus.DOS.BackTime.1234

Other detailsEdit

BackTime.496 contains the internal text string:

Joker

BackTime.512 contains the internal text string:

Shaker

BackTime.527 and 528 contain the internal text string:

BackTime

VideosEdit

Virus.DOS.BackTime00:43

Virus.DOS.BackTime.528

BackTime virus review by Alles Sandro

BackTime DOS Virus00:44

BackTime DOS Virus

BackTime virus review by danooct1

Ad blocker interference detected!


Wikia is a free-to-use site that makes money from advertising. We have a modified experience for viewers using ad blockers

Wikia is not accessible if you’ve made further modifications. Remove the custom ad blocker rule(s) and the page will load as expected.