FANDOM


Virus.DOS.BackTime is a dangerous memory resident parasitic virus on DOS.

There are 5 variants in 4 versions, represented by the following:

  • Virus.DOS.BackTime.496
  • Virus.DOS.BackTime.512
  • Virus.DOS.BackTime.527
  • Virus.DOS.BackTime.1234

BehaviorEdit

When the virus is loaded into memory, it hooks INT 8 and 21h to infect any DOS executable file that is run.

BackTime.496 might not restore the registers when INT 8 is called.

Debugging is required for BackTime.527 for its runtime, otherwise it would print an "S" and then exit without staying memory resident. BackTime.528 is the bug fixing release.

BackTime.1234 also drops the virus Stoned.Michelangelo to the boot sector when it is run, and the dropped virus consumes 2K of memory.

Advanced detailsEdit

The TSR memory usage of the variants:

Variant Memory usage in bytes
BackTime.496 512
BackTime.512 528
BackTime.527 ?
BackTime.528 544
BackTIme.1234 1,792

MD5 hashes:

Variant Hash
BackTime.496 de8434ade059bd5a254910a4a560aaaa
BackTime.512 06dad4277bc63a28cb2f0672503f70f4
BackTime.527 c244374e155a15eafcd848255fa0fc62
BackTime.528 0a438b5000da7bf075bd4767a6e38acf
BackTime.1234 76a7a42d947ea9239e4cb7078d096ca1

PayloadEdit

BackTime.496Edit

This variant does not manifest itself.

BackTime.512Edit

This variant manifests itself on CGA-adapter only, it "shakes" the screen.

BackTime.527 and 528Edit

This virus sets the system timer in back direction, when the INT 8 is called the virus decrements the content of timer counter. At a result the programs that uses the timer characteristics of computer (like a BenchMarks) would hang-up.

However the virus does not change the time in CMOS memory, when the computer is rebooted, the time would restore, if the virus is not loaded again immediately.

BackTime.1234Edit

This variant does not manifest itself, while the dropped virus does on March 6th.

VariantsEdit

This family has 5 variants in total:

  • Virus.DOS.BackTime.496
  • Virus.DOS.BackTime.512
  • Virus.DOS.BackTime.527
  • Virus.DOS.BackTime.528
  • Virus.DOS.BackTime.1234

Other detailsEdit

BackTime.496 contains the internal text string:

Joker

BackTime.512 contains the internal text string:

Shaker

BackTime.527 and 528 contain the internal text string:

BackTime

VideosEdit

Virus.DOS.BackTime00:43

Virus.DOS.BackTime.528

BackTime virus review by Alles Sandro

BackTime DOS Virus00:44

BackTime DOS Virus

BackTime virus review by danooct1

Ad blocker interference detected!


Wikia is a free-to-use site that makes money from advertising. We have a modified experience for viewers using ad blockers

Wikia is not accessible if you’ve made further modifications. Remove the custom ad blocker rule(s) and the page will load as expected.