About Scratch :: Advanced Topics :: Computer Viruses

Flowermanvista :

Flowermanvista wrote:

Jeffalo wrote:

Boomer001 wrote:

In a danooct1 video, a virus did this:

format "C:\" /q

Does that actually erase your C drive?

i would try it but i think that might be stupid. perhaps in a vm

In this form, no. Instead, the format will fail with a “parameter format incorrect” error.

By changing the command to this:

format C: /q

it would work, but with two caveats: it can only be done from MS-DOS mode (example: putting it in autoexec.bat), and there is no way to automatically answer “yes” to it asking to confirm that you want to lose all data on drive C:, so most users would probably answer no to this question (the more savvy ones would then remove the offending line from autoexec.bat), and ultimately the malware will fail in its efforts.

I was wrong about this. By using a pipe to pipe the output of the “echo” command into the “format” command, like such:

echo y | format C: /q

a quick format will be performed without user intervention. If the malware wants to not inform the user that is is formatting their C drive, a redirector can be used to redirect the output of the “format” command to the null device (NUL:), and the “@echo off” command can be used so that the user does not see it issuing the format command, like so:

@echo off
echo y | format C: /q > nul

This will result in a user only seeing a blinking cursor. Either way, attempting to restart will result in a “Non-system disk” error.

from Latest posts on Advanced Topics https://ift.tt/2BL0Nlg