Story URL:
http://software.silicon.com/malware/0,3800003100,39125000,00.htm
Virus alert: Bacros goes back to the future
Jo Best
silicon.com
October 14, 2004
Like pixie boots and Bros, some things are better off left in the 1980s - like viruses that spread via floppy discs and tried to wipe hard drives. It seems no one told the virus writers that, though.
Finnish antivirus firm F-Secure has spotted a new virus, Bacros, doing the rounds. Unlike the average virus which spreads over email, IM or networks, Bacros is going back to the old school and copying itself to floppy discs and burning itself to CD-ROMs by using an autorun file in order to spread, although it can't copy itself to other portable storage like USB sticks. It infects local filesystem files by renaming all .txt files as .exe.
Bacros' harking back to the bad old early days of viruses doesn't stop there, though. Instead of using the infection to recruit a zombie army and make some money from spammers, Bacros goes for simple destruction.
If it infects a PC, the virus will delete all files from the victim's hard drive on Christmas Day.
In another sign that the writer behind Bacros is more likely after notoriety than cold, hard cash, the malware author has taken care to put his own distinctive stamp on the infected PC. On the first of any month, the virus will overwrite all gif files with a gif that says 'Kuole Jehova' - 'die Jehovah' in Finnish.
The writer also makes use of images to subject the victim to his patriotic side - on Finland's independence day, 6 December, the virus will set a small graphic of the Finnish flag as the background on the system.
Copyright © 2003 CNET Networks, Inc. All Rights Reserved.
silicon.com is a registered service mark of CNET Networks, Inc.
silicon.com Logo is a service mark of CNET NETWORKS, Inc.
----
It sounds like someone in Finland has just been disfellowshipped and is totally pissed off!!
Regards,
Ken