FANDOM



Saiyeed is a virus created by Faissal Bensefia in May 2014.

Creation

An argument regarding the creation of malware using the YoYoGames programming language, GML. Faissal challenged himself to create a strong virus using the language, yet this virus does contain elements of Batch. The virus is not wild (in other words, it was for experimentation purposes only).

The virus was originally called "lockette", named after Faissal's brother's friend. However after some experimentation and work, it was renamed Saiyeed, after a character invented at Kemnal Technology College.

Payload

The virus starts off by setting the screen frequency to 80, the resolution to 800×600 and the colour depth to 16-bit. This is used to make it difficult to work around the screen-locker. It then locks the mouse in place and hides it. It also drops a 'compiled' Batch file called killer.exe which runs silently.

A image of a stick figure with an upside down head and a party hat (Saiyeed) is then displayed on the screen with text below it and a count down (which occasionally hangs). The virus proceeds to scan the user's downloads folder for files with the following extensions:

  • .exe
  • .gml
  • .bat

It replaces all .EXE files it finds with an exact copy of itself, replaces whatever code is inside .GML files with the code that is meant to execute the copy of the virus that is currently running. However, it has a Syntax error which prevents this. It also does something similar with Batch files, only that the Batch files will still be functional.

After 15 seconds it will then initiate a transition to another image where there are 0-3 stick figures. The number of stick figures varies on how many removable media devices it finds. However, it only checks the Q:\, H:\ and E:\ drives for removable media. It then proceeds to repeat what is done to the downloads folder.

After this, it closes and deletes killer.exe, returning the resolution to normal. However, the Batch file continues to run, preventing the user from accessing Task Manager. This process can be killed by going into command prompt and typing in:

taskkill /IM killer.exe /F
taskkill /IM cmd.exe /F

Variants

  • B Variant: The B variant of Saiyeed implements a standard batch file rather than a compiled batch file to fix compatibility issues with Windows XP.

Videos

Ad blocker interference detected!


Wikia is a free-to-use site that makes money from advertising. We have a modified experience for viewers using ad blockers

Wikia is not accessible if you’ve made further modifications. Remove the custom ad blocker rule(s) and the page will load as expected.