Massive consumption of personal computers began during the 1980s. At that time, MS-DOS was the dominant operating system and Internet was not available for most consumers yet. Files were copied and shared on floppy disks and consisted mainly of application programs or video games.
In order to prevent piracy, some software companies created viruses to educate non-legitimate users; they included contact information so those affected could request a cure. In other cases, computer programmers designed viruses that presented no risk to operating systems. Their intentions were to hamper the smooth functioning of the PC, attract victim's attention by propagating a political or philosophical idea, or -in the worst case- to destroy information.
The first manifestations were mainly technological demonstrations and the motivation behind was based in experimentation, rather than the development of malicious codes. But in short time, new dangerous viruses entered the scene. Their behaviour was similar to that of a biological virus as it rapidly replicated and spread to other networked machines. That is why in 1984, the term “virus” was adopted to refer to them, although there are records of such threats in the 1970s.
The constant sharing of programs between users, caused viruses to reach international dissemination giving birth to antivirus companies. What started as a harmless prank, today represents an international cybersecurity problem, so much so that malware design remains anonymous and clandestine.
A computer virus is, in short, a small application written to perform certain tasks. In the years of MS-DOS, it was a common practice to replace an executable file .exe or .com with one infected, capable of modifying the originally scheduled instructions. Virus were activated only if a user ran them and their visual appearance was typically based on early video games, made up of pixel graphics, basic animations, rudimentary landscapes, speaker beeps and absurd or challenging messages.
This exhibition brings together a variety of DOS-based viruses. They were captured on video through the use of emulators which allow to appreciate their original presentation, although without their destructive routines. The selection includes viruses that stand out for their creativity and sophistication both in visual and functional aspects; An approach to the aesthetic dimension of disruptive phenomena in digital ecosystems.
Thanks to collaborators: Mikko Hypponen (Malware Museum), Ian Webb, Pulzeultra, Tom.K, Alles Sandro, danooct1.
This virus destroys part of the system information in the C: disk boot sector. Once activated, it plays the first verse of the former USSR national anthem and overwrites the screen with information about the author.
Hymn.1865 contains the following internal text strings:
ibm@@SNS
@ussr@@@@@
Inspired by The Terminator movie, this virus infects all .EXE files and slows down the PC dramatically. After a number of processes, the virus makes a "shutdown" video effect and slowly types out a message on a red background. When a key is pressed, it will display the following message: *** Terminator I *** Created by Sky Net in Chung-Li.
Crash.600 also known as Leningrad, is a non-resident parasitic virus that infects practically all .COM files on the PC. When an infected program is run, sometimes displays random colored bars and nonsense characters on the screen, a process which may crash the system.
Internal text strings:
*.COM
PATH=
HH&HH is a memory resident encrypted parasitic virus. When is run on Mondays, scans the screen for the text string: Esik. If found, it sets the monitor to graphics-video mode and after a few seconds, launches a running ball which movements generate an abstract drawing.
The virus contains the internal text strings:
#(-28=CIPV]HARD HIT & HEAVY HATE the HUMANS !! [ H.H.& H.H. the H. ]
Valentin Populizeroff & Alexander LovInGodsky - it's a fuck !
MultiScan & Tchechen it's a big ass hole !!!!!!!!!!!!!!!!!!!!
*************************************************************
(c) Gurre, Wadimka, Good Doggy & Grosser-Hide Group Moscow
When the virus is run, the computer will show the message: "This is a huge sample!" and won't do anything else. On the 10th day of any month, it activates a graphic animation which generates an infinite visual array of red, black, blue and green diamonds growing outwards from the center of the screen.
The virus also contains the following internal text:
HYPNOTiSER. By bQNVvLA&|^JM :6'
Lichen is a non-dangerous memory resident parasitic virus. It hooks and writes itself to the end of .COM and .EXE files that are executed. One month after infection, the virus inserts more codes and manifests itself by a video effect that simulates a lichen grow. The graphic animation resembles the behavior of a cellular automaton.
Once the virus is activated, a man appears walking across the screen. At this moment, any input by the user is disabled until the man is left. The character was taken from the videogame Bad Street Brawler.
This virus contains the following message:
WALKER V1.00 - This absolutely harmless and self destructive program is written by UJHPTTLZ in the city of Istanbul, 1992.
VirDem-1542 variant is a non-resident direct action infector of .COM files. If there are no more files to infect in the entire disk, the virus switches the screen to CGA mode and displays a colorful moving pattern in ASCII colors. This is the only variant that shows this graphical effect.
Contains the following internal text string:
a:\lo*.*
Billiard.2658 is a memory resident and partially encrypted virus that runs on MS-DOS. On the 31st of any month, the virus manifests itself with a video effect that simulates a Billiard play. While eating the symbols on the screen, it makes ticking sounds emitted from the PC speaker.
Cosmos (variant 1120.b of Spanska virus) is a non-resident parasitic encrypted virus. When the minute is equal to 52 and second is less than or equal to 20, it displays a graphic animation of the interstellar space. This virus does not remain in memory after execution.
Mars Land (variant 1474 of the Spanska) is an encrypted parasitic virus, which activates when the minute is equal to 30, and the second is less than or equal to 30. When is run, displays a scrolling topographical map of Mars. This variant includes the following internal text:
SPANSKA PresentMars L
Mars Landing|μ♥ *.* *.C* *.E* .
Techno is a non-resident overwriting virus which permanently corrupts the programs it infects. Once is activated, it uses the CPU's audio device to play a tune created by the author which lasts 1:49 minutes. While the tune is playing, the word "TECHNO" is typed all over the screen in a slow manner. If the user interrupts during the payload, it shows the message: »Don't touch the keyboard«
Sometimes, it displays the text:
Hello - This is a 100 COM test file, 1993
Vanitas is a memory resident encrypted parasitic virus. On March 27, the virus manifests itself by a video effect that shows animated particles forming abstract geometric patterns based on mathematical formulas.
This virus contains the following message:
VANITAS++ v2.0 GR(c)97 by ANAX.
[E-75] goes to Hell. Have a nice death...
LSD is a dangerous nonmemory resident parasitic virus. Every file located in the infected program drive's root directory becomes corrupted. After overwriting the files, the virus manifests itself with a colorful video in "plasma effect".
When a key is pressed, it shows the following message:
LSD ViRuS 1.0
Coded By Death Dealer 4/29/94
[TeMpEsT -94]
The virus contains the following internal text:
Author:Death Dealer Of [TeMpEsT]Virus:[LSD]
Magdzie is a memory resident parasitic stealth virus. When an infected program is run on May 27th, the virus switches to video mode, and manifest itself with a colored video effect plus the message:
Magdzie T. - jutro Twoje urodziny!
(From Polish: Magda T. - tomorrow's Your birthday!)
When an infected program is run on Friday 25th of any month, the virus displays an ASCII image with a message and after that, it hangs the system. Rebooting on this date causes the message to show up again and again, it is impossible to use the PC on that day.
Suicide.2048 is a memory resident encrypted parasitic virus. It searches for .COM and .EXE files, and then writes itself to the end of the file. Randomly displays an image of a large hanging head followed by a three-tone beep on the PC Speaker. It contains the following text strings:
*.COM *.EXE ..
[Suicide]
Written by Dark Angel of PHALCON/SKISM
Ross M. Greenberg blows goats.
Coconut is an encrypted DOS virus that overwrites files. If a file infected with Coconut virus is executed on August 31st of any year, it shows an ASCII image of a smiley face with fangs. If the user reboots the computer, it will display the following message:
Bad or missing Command Interpreter
Enter correct name of Command Interpreter (eg, C:\COMMAND.COM)
MadMan is a memory resident encrypted parasitic virus. On Ctrl-Alt-Del command, the virus displays a red ASCII image of an angry man face and after a few seconds, it shows the message:
Nothing can save you here, friend - you're in my world now!
In any attempt to manipulate .bat files (adding/removing), it adds an ECHO command with the line:
I'm watching you!
Bones is a DOS trojan which can be easily removed by restarting the computer. Once the virus has been run, it will display an ASCII art image of a Skull, made up of numerous characters.