Fandom

Malware Wiki

LunchTime

1,319pages on
this wiki
Add New Page
Comments0 Share

Virus.DOS.LunchTime.2050 is a memory resident parasitic virus on DOS.

BehaviorEdit

When the virus is loaded into memory, it hooks INT 21h and infects any EXE executable that is run by writing itself to the end of the files. The virus does not infect files with the name MKS* (Polish anti-virus).

The virus searches and deletes the antivirus data files if found:

CHKLIST.MS
CHKLIST.CPS

Some infected programs might not function properly and cause a system hang when run.

Memory usageEdit

The exact memory usage is 4,352 bytes.

PayloadEdit

When an infected program in run between 12:00 and 13:59, the virus displays the message and temporary hangs the system:

Po co tak ciezko pracujesz ?
Zrób sobie przerwe i idz na lunch.
Twój dysk twardy zostal zakodowany do godziny 14:00.
O tej godzinie zostanie odkodowany. Jesli wylaczysz
komputer wczesniej, stracisz na nim dane bezpowrotnie.

Czas do konca przerwy : (time)

NIE WYLACZAJ ANI NIE RESETUJ KOMPUTERA !!!

Translation (from Polish):

Why you work so hard?
Take a break and go for lunch.
Your hard drive has been encrypted until 14:00.
About this time it will be decrypted. If you turn off
the computer earlier, you will lose the data forever.

Time until the end of the break: (time)

DO NOT TURN OFF OR RESET THE COMPUTER !!!

However the virus encrypts nothing on the disk.

Other detailsEdit

Due to some programming faults, the virus does not count for the last minute and then it would return to DOS, so it will not activate after 13:59.

The virus also contains the text strings:

Jakze tu wszedles,powiedz i dlaczego?
Nielatwo wspiac sie na ten mur wysoki.
I smierc tu znajdziesz,zwazywszy, kim
jestes, Jesli cie spotka którys z moich krewnych.
Lunchtime  Kraków -styczen 97

Translation (from Polish):

How will you get in here, and tell me why?
Not easy to climb on the high wall.
And here you will find death, Considering who
you are, if I meet any of my relatives.
Lunchtime  Krakow -styczen 97

VideosEdit

Virus.DOS.LunchTime01:35

Virus.DOS.LunchTime.2050

LunchTime virus review by Alles Sandro

Ad blocker interference detected!


Wikia is a free-to-use site that makes money from advertising. We have a modified experience for viewers using ad blockers

Wikia is not accessible if you’ve made further modifications. Remove the custom ad blocker rule(s) and the page will load as expected.