Virus.Win32.WinfigYouTube↗  IA↗(long shot)
Entertainment  329.5K views 5.8K likes 145 dislikes   04 Jun 2017
danooct1 318K subscribers United States YouTube↗


Please select the problem
You must specify your email and describe the problem in detail
Describe your problem in detail if it's not obvious

Contributed subtitles
English me when i
Ni- Na
Russian Fishgoggles
French L'autre Pommé
German r4indeer
Chinese Hedwig Zheng
Sky Loïc Fu
Portuguese (Brazil) user-24Sj389
Click to Play Video Click to Play Video
大家好，今天我们来看看Winfig。
Hello everyone, today we're taking a look at Winfig.
一个写给Windows 9x内核的病毒。
A virus written for the Windows 9x Kernel.
但我们要在Windows ME看看，
And we are looking at this on Windows ME,
因为不管咋样，这个病毒在这个系统工作特别的好。
because for whatever reason it works best on this particular operating system.
然后我们来运行Winfig，把鼠标划到这。
So, we'll go ahead and run winfig, get the ball rolling here.
然而什么都没有发生。
And nothing appears to have happened.
它不会感染文件，
And instead of infecting files,
取而代之是检测软盘槽，如果有个软盘在里面，它会复制自己进去。
this actually checks the floppy disk drive periodically, and if it finds one, it will drop itself to it.
所以当你注意到你有了病毒，
So you might notice that you have this virus,
你可以看见一些东西落在了你的软盘里。
when suddenly you're having stuff randomly written to your floppy disk drive.
当你没用它的时候。
When you're not using it.
还有就是它把它自己复制到了Windows目录，如果我们划下去看。
So we can see that it dropped it's file here in the Windows directory, if we go ahead and scroll down.
用着默认文件夹图标。
Uses the default folder icon.
自称winfig。
Calls itself winfig.
因为这是给9x内核写的，
And since this is on the 9X Kernel.
翻看下WIN,INI，有条命令要求运行[病毒自己]
We use WIN.INI, and it tells it to run "C:\WINDOWS\WINFIG.EXE"
所以开机时，病毒就会自启。
So this enables the virus to start when the computer starts.
那么接下来看看发作在何时吧。
Go ahead and move along to the payload.
恰巧在十月一日发作。
Which coincidentally starts activation on October 1st.
也许你知道那对于我和这个国家来说都是很重要的日子。
And you might know that's kind of an important date to me.
所以我们更改日期到那天去。
So we'll go ahead and change it to that day.
2001年十月一日。
October 1st, 2001.
然后我们重启。
And we'll just go ahead and restart.
因为病毒开机会自启，
And since the virus runs on startup,
电脑重启后我们就能看见了。
we will see it, when our computer reboots.
所以当我们在十月一日或者之后的日期开机。
So, when we boot up here, on October 1st or any date after that.
我们能看见... ♫ Windows ME 开机声 ♫
We will see.. ♫ Windows ME Startup Sound ♫
我们的壁纸换成了一大堆外星人。 ♫ Windows ME 开机声 ♫
♫ Windows ME Startup Sound ♫
然后我们看见屏幕慢慢打出一条消息。
Our background changes to a bunch of aliens. ♫ Windows ME Startup Sound ♫ And we get a slowly typed out message.
来自病毒作者。
From the virus author.
翻译后差不多是..
Which, translated, equates to..
"梅丽莎病毒，"
"Virus Melissa,"
"当你运行了我，我爱上了你，自从那时，我一直准备有天可以碰见你。"
"When you infected me, I fell in love, since then, I've been preparing myself to meet you, one day."
"我已经在因特网和软盘里自我传播了很多个月，但我现在不干了，"
"I've been reproducing myself for several months through the internet and floppies, but now I stopped,"
"我不准备追你了，但如果我不能拥有你，没有人会可以。"
"I'm not going to run after you anymore, and if I can't have you, no one else will."
"我爱你，梅丽莎。"
"I love you, Melissa."
"-卡洛斯病毒。"
"-Virus Carlos."
然后消息打完，
And then, once it's done.
另一条消息随之弹出。
[It] pops up another message.
♫ Windows ME 错误声 ♫
♪ Windows ME Error Sound ♪
这就是了！
There we go!
翻译：
Translates to:
"你的电脑已被卡洛斯病毒感染。"
"Your computer has been infected with the Carlos virus."
"重启你的电脑。"
"Reboot your machine."
然后，这就是为什么要让你重启：
And, the reason why it asks you to reboot your machine.
如果我们回到Windows文件夹。
is because if we actually go back into our Windows folder here.
我们看.. 已经..
We will see..
[吸气！]
That it has..
删了WIN.COM！！
[gasp!] DELETED WIN.COM!!
它消失的无影无踪！
It's just totally gone!
所以我们的电脑不能启动了！
So our computer won't boot!
除非。
Except.
这是Windows ME。
This is Windows ME.
没有WIN.COM也可以启动。
And, it will boot just fine without WIN.COM.
最后一件事它会做的。
One last thing the virus does.
如果我们向上看。
If we scroll up here.
我们能看见...
We will see...
在System，
in System,
有一大堆叫做（玛丽莎和卡洛斯）新文件夹
that we have a bunch of new folders called: "Mellisa & Carlos"
我想有315个。
1 through 315.
或者0到315.
Or 0 through 315.
这就是一大堆空白文件夹。
It's just a bunch of empty folders.
删除很简单。
Pretty easy to delete.
但不算太坏。
But, not too bad.
如果我们运行的是Windows 95或98，
If we were running Windows 95 or 98,
在AUTOEXEC.BAT(自动启动)里，
in our AUTOEXEC.BAT file,
病毒会在里面写删除WIN.COM的命令。
The virus would've written some commands to delete WIN.COM.
然后启动时给你个消息。
And display a message on bootup.
但，因为我们用的Windows ME，像我所说，这没效果。 所以这就是Winfig。
But, since we're on Windows ME, as I said, this isn't really effective. So, that's about it for Winfig.
有毁灭性，但恢复很简单。
Somewhat destructive, but not really hard to recover from.
只用拷贝一份纯净的WIN.COM，
Since you can just, easily replace WIN.COM from a clean copy.
然后就当什么没发生。
And you're good to go.
这就是结尾了，
And that's about it,
你得到了一个很酷的外星人背景，
You get this cool alien background,
还有这个你可以一直留着的消息。
and this neat message and you can just as long as you want.
这就是真结尾了。
And that's about it.
感谢你的收看。
Thank you for watching.
再见。
Take care.
♫
♫
Similar videos:

Virus.MSWord.Appder (Win16)
danooct1
87.1K views 2.1K likes 19 dislikes 28 May 201795% match

Trojan.Win32.VeryFun (Viewer-Made Malware 18)
danooct1
961.2K views 15.9K likes 463 dislikes 11 Jun 201793% match

P2P-Worm.Win32.Mantas
danooct1
98.4K views 2.6K likes 22 dislikes 25 Jun 201790% match

Email-Worm.Win32.Lacon
danooct1
104.1K views 3K likes 26 dislikes 16 Jul 201780% match

Petya/NotPetya Ransomware Spreading via LAN
danooct1
136K views 3.1K likes 31 dislikes 29 Jun 201780% match

Trojan.Ransom.Petya (Petya 2.0 2016 Ransomware, flashing lights warning)
danooct1
451.9K views 8.8K likes 129 dislikes 27 Jun 201777% match

Trojan.Win32.Alerta
danooct1
959K views 16.6K likes 509 dislikes 07 May 201777% match

Virus.DOS.Michelangelo (25 years later)
danooct1
362.7K views 8.2K likes 86 dislikes 06 Mar 201771% match

Email-Worm.Win32.Magold
danooct1
177.3K views 3.9K likes 39 dislikes 04 Feb 201770% match

Trojan.Ransom.Rensenware
danooct1
1.5M views 38K likes 657 dislikes 09 Apr 201766% match

Net-Worm.Win32.Sasser On a Physical PC Network
danooct1
416.8K views 6.7K likes 113 dislikes 30 Apr 201462% match

Trojan.JS.YouAreAnIdiot
danooct1
5.1M views 103.3K likes 2.2K dislikes 19 Oct 201562% match



IRC-Worm.Win32.Fagot
danooct1
556.8K views 8.1K likes 192 dislikes 21 Jan 201360% match

Email-Worm.Win32.Maldal
danooct1
263K views 2.5K likes 21 dislikes 24 Jan 201360% match

Virus.Win16.Apparition
danooct1
287.1K views 3.6K likes 37 dislikes 07 Sep 201260% match

Email-Worm.Win32.Gruel
danooct1
186.7K views 1.8K likes 17 dislikes 09 May 201360% match

Viewer-Made Malware 10 - Zika (Win32)
danooct1
759.7K views 14.2K likes 274 dislikes 09 Sep 201658% match

Viewer-Made Malware 7 - DeepUnder (Win32)
danooct1
565.5K views 8.4K likes 155 dislikes 17 Jun 201658% match

Viewer-Made Malware 3 - Mist (Win32)
danooct1
548.5K views 8.5K likes 218 dislikes 29 Jan 201658% match

Viewer-Made Malware 4 - Resonate (Win32)
danooct1
369.2K views 5.5K likes 59 dislikes 12 Feb 201658% match

Trojan.SymbOS.Fontal
danooct1
1.3M views 23.1K likes 971 dislikes 13 May 201657% match


Virus.Win32.Rigel
danooct1
151.2K views 1.4K likes 22 dislikes 31 May 201355% match

Viewer-Made Malware 8 - MEMZ (Win32) (flashing lights warning)
danooct1
1.8M views 30.4K likes 550 dislikes 08 Jul 201652% match

Email-Worm.Win32.Magistr (Thanks for 100,000 subscribers!!!)
danooct1
377.5K views 10.4K likes 62 dislikes 17 May 201652% match

VineMEMZ (Win32)
danooct1
336.4K views 7.9K likes 136 dislikes 23 Dec 201651% match

Virus.DOS.Hate
danooct1
156.6K views 1.6K likes 21 dislikes 22 Jan 201549% match

Virus.MSExcel.Neg
danooct1
185K views 3.5K likes 58 dislikes 02 Apr 201749% match

Virus.DOS.Espacio
danooct1
186.5K views 3.3K likes 24 dislikes 06 Feb 201449% match

Happy 17th Birthday, Windows 95
danooct1
299.3K views 4.5K likes 95 dislikes 24 Aug 201247% match

Running the Ukraine Virus on Windows 98
danooct1
178.5K views 1.3K likes 70 dislikes 18 Jul 200947% match


Settings Privacy About Contact Donate