Fandom

Malware Wiki

Excess

1,321pages on
this wiki
Add New Page
Comments0 Share


Virus.DOS.Excess.3529 or Excess is a destructive virus that runs on MS-DOS.

Behavior Edit

When the virus is being loaded into memory, it first prints "Hello, World", and then it starts infect .COM and .EXE files that are executed. The virus behaves stealthly so that there is no observable size change to infected files and free memory space.

Payload Edit

The virus payload is very similar to that of Casino. It activates when the system timer lands on an obscure memory address (but in danooct1's video, the virus date condition has been modified by FlightCPUBoy, to Tuesdays) while executed by playing three short beeps and printing a (threat) message:

DANGER!
You are infected by ExCESS Virus (C) 1995 The Nuker

I have destroyed your FATs but I only have one copy in
my data area. IF YOU REBOOT NOW ALL YOUR DATA WILL BE LOST.
If this isn't enough, I have altered your Master Boot
Record with a formatting routine in order to low-level
format the primary Hard Disk when executed. If you are
so dude and you don't believe me, reboot now and look
at your hard disk light spinning... If you don't want
to loose all your data then try to guess a number from
0 to 9 and pray for your answer to be correct, else...

Then the virus starts a "guess a number" game. The user have three chances to guess the correct number chosen by the virus. To make the game harder, the virus randomize the correct number for every guess.

If the user wins, the virus will print explicit message, swearing to the user: (the actual message is not censored)

You f**king S**T!!! You guessed the right number!!!
You are safe this time but next will come very soon
and you will not be so lucky!!!

Note the sublte English usage in this message.

After the user win the game, the main virus command process will terminated, and (sometimes) finds for infected background progress exist in memory. If it does, then the virus re-run the routine.

But in this case, if the user lose the game, it prints a fake win message (to calm down the user from being threatened):

Hum.. you are lucky this time...
Please wait while reconstructing disk structure...

Then the virus display a real loading screen - which is actually progress of the virus wipe out the hard disk and overwrite the MBR with the virus' routine. When it's done, the virus plays three short beep again and displays it's final message: (the actual message is not censored)

I WAS JOKING!!! Your Hard Disk has been f**ked up!!!
Thank you for choosing another product of...
-T-h-e- -N-u-k-e-r- 

After this message printed, the system is totally halted from this point, and the keyboard input is also disabled. The user must perform a hard reset in order to reboot the computer, but the machine will stuck on CMOS, since the whole hard disk has been removed completely by the virus itself.

Ad blocker interference detected!


Wikia is a free-to-use site that makes money from advertising. We have a modified experience for viewers using ad blockers

Wikia is not accessible if you’ve made further modifications. Remove the custom ad blocker rule(s) and the page will load as expected.