Viral Rewind: Virus.Win9x.Matrix

Visit my Linktree to access my socials and other channels: linktr.ee/mausolfb
-----------------------------------------------------------
. Matrix is a "harmless" memory-resident polymorphic virus for Windows 9x systems. When loaded it installs memory-resident in Windows as a VxD driver thereby providing file access and thus able to infect .EXEs and .SCRs as they're accessed (encrypting its code within the program and marking the generation of the virus). It will also infect DOS executable programs (.COM) with a text/halt payload. It will also search for any virus database files with the following names and delete them:
"AVP.CRC, ANTI-VIR.DAT, IVB.NTZ, CHKLIST.MS."
Payloads:
On the 6th of April regardless of year Matrix inserts a new registry entry within HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer of the Windows registry called "NoClose" and sets it to "1" (true). This policy prohibits Windows Explorer from allowing shutdown (removes the shutdown function from the Start Menu and from Task Manager).
On the 7th of July regardless of year when an infected DOS executable (.COM) is run the program will output the following to the screen:
"Wake up, Neo...
The Matrix has you...
w9x.mATRiX"
Afterwards it will HALT the processor which stops all activity on the machine and a hard reset/power cycle will be required.
-----------------------------
Like the Facebook page: / brian.mausolf
Follow me on Twitter: / mausolfb

[@wadmodderschalton5763]

A worm that was capitalizing on The Matrix.

[@OrangeShellGaming]

The 'HALT' isn't really a halt, the virus just disables interrupts and loops forever. Since every means of getting out of the loop would involve interrupts (including e.g. Ctrl+Alt+Del which is handled as a standard interrupt internally), the loop causes the entire PC to lock up. Likewise, without interrupts, Windows cannot pre-empt processes and thus multitasking also stops working. (There could be non-maskable interrupts or NMIs that cannot be masked away by disabling interrupts, but IBM PC's don't use those for much, mostly memory parity errors.) HALT in x86 has a specific meaning: it's an instruction (HLT) that stops the CPU clock until an interrupt occurs. But why would a virus author use that, when they can just do an infinite loop...