Viral Rewind: Virus.DOS.Girls

Visit my Linktree to access my socials and other channels: linktr.ee/mausolfb
-----------------------------------------------------------
. Allow me to crush your expectations: there are no girls here... But that is the name given to this piece of DOS malware from it's printout given upon execution of an infected program on it's payload date. Girls is a direct-action infector so unlike TSRs that stay in memory and infect any file that is run thereafter this will just infect all .COM and .EXE files in the present directory the virus is run from. This will be quite apparent to the user depending on the number of files in the directory as it creates a noticeable loss in disk performance. There are two variants 1829 and 1874; both infect and have the same payloads and activation dates (they just have slight differences).
Payload: When the system date is either March 18th or October 8th of any year and an infected program is run three things happen:
1- The infected program will scan the directory for more .COM and .EXE files to infect.
2- It will display the following text "I love you, girls ! You are so beautiful !" (This is where it is named from).
3- It will play a rendition of "Yesterday" by The Beatles over the PC speaker.
It then executes the program as it normally would run while the song plays over the speaker (it doesn't hinder user activity).
#malware #girls #dos
-------------------------
Like the Facebook page: / brian.mausolf
Follow me on Twitter: / mausolfb

[@Danjovisagat]

That intro is noice!