Chernobyl virus

Since I finally got VirtualBox to run Windows 95, after some tedious tweaking, I decided to finally test the CiH virus. What I did is I did a fresh install of Windows 95, made a simple PE executable in FASM (dialog box in the video), and finally attached the virus :) What you see in the video is I first open the bait program in Notepad to show it's uninfected ASCII. I then ran the virus and re-ran the bait program. As you can see the infection marker, 'U', has been added right before the 'PE' header. Finally I destroy the machine by setting the date to April 26th :)
NOTE: I believe the bait file may not have been infected due to size issues, but the infection marker is still there and destroyed my computer.

Category:

Science & Technology

Tags:

• chernobyl
• virus
• CiH
• windows
• 9x
• 95
• DOS

[theyoshimarioguy]

umm wats up with the 2 mouses?

[acount134]

@theyoshimarioguy it's the screen recorder. There is one virtual mouse used in the VM and the actual mouse on my desktop. The screen recorder records both.

[KaxFin]

The size didn't change because CIH uses "multiple cavity infection"-method (see wikipedia). In layman's terms, it uses empty pre-existent spaces in files.

[acount134]

@KaxFin I know what multiple cavity infection is and if there isn't enough slack space in the file, then IT WON'T INFECT IT! The CIH virus places a marker on every file it reads and if the file isn't able to be infected, it places a marker in the PE header stating so. I write only in Assembly Language so I control the size of each part of my executable and I chose not to include enough empty space in the file for the virus to infect.

[Rajput4408]

u r using window 7 but it looks like millenium or win 98 how u do this

[acount134]

@Rajput4408 this is windows 98 running in 7 via virtualbox

[jumbojokerjesse]

computer goes rabid, just blast it with a 12 gauge, problem solved. build a new PC!

[TheBaDHD]

FASM is Awesome!

[TheLolasboy]

Looks like a computer invented from 1998

[TheBaDHD]

AWESOME

[rinkavideos64]

@theyoshimarioguy One is the emulated virtual mouse, other is the actual mouse. By the way, it's mice, not mouses.

[SuperSkillage]

on my birthday computers get destroyed

[olty49]

OMG! when I entered this video a virus alert poped-up in my monitor! o_O

[VBEducation1]

@theyoshimarioguy its just the virtual box thing becuase its captured