Today, I poked around in a folder full of random unknown executable files in an attempt to find some of my old crap... Umm... Yeah...
That'll teach me to do that won't it?
I don't know how many people here know my past, but I think it is known I have worked in ICT and it is a given that there were people I did not get along with. This program affects Windows 9X systems... In fact, it is two programs.
The first program;
A simple program tests the root of C: for some .DXZ files which are a backup of AUTOEXEC and CONFIG, if they don't exist they are made as copies of the existing files before some lines are appended to those and an executable is copied. The program, named TETR1S, then calls a copy of a Tetris game for MS-DOS without alerting the user to what it has done. The program will not tamper with files if the DXZ files exist, DXZ relates to the alias I was using at that time.
The second program;
This whole thing was written for one guy only because he made my job hell, it was inspired by early MS-DOS malware. It is called from Autoexec when the system boots. Very primitive, like that game I am working on today... In fact, it is where I learned some of the ANSI stuff that game uses, but there isn't any fun to be had when the program is running. When it appears, it displays red flashing text stating "GAME OVER!" and explains in white that the moron should leave money beneath his keyboard, then blackmails him. The price doubles from ten to twenty when the code is not entered correctly. The program then renames WIN.COM (despite the message) if the code is incorrect again and display a screen which is blank aside from flashing red text stating "YOU BLEW IT!"... The code is 036755 for those that care, I don't remember to what this refers, it may be the companies phone number - but I have never seen one start with a zero as that would likely tell the hardware to dial outside of the city, for which purpose it is too short, so it probably isn't and I can't test because the company went bust years ago... Who knows what it refers to then, but it would have been something as I'm not good at random stuff, I like to have a solid reference point somewhere.
There are two other possible exits. One of them displays green writing saying "You rule! Thanks for the cash! I'll be in touch when I need more!" and cleans up the mess (though it does not remove the TETR1S program) allowing the system to start normally. The other bypasses the whole thing, the program rattles A: for a file called "TURNKEY.DXZ" which can be anything so long as it exists. This causes the program to run the cleanup and exit silently, it will remove TETR1S provided it is in C:\MYDOCU~1.
A few other points of interest are that the program contains text the user never sees, most interesting is a shopping list of what I planned to eat for lunch. The program is TIVOLI.COM but internally it refers to itself as "LUNCH AKA TIVOLI AKA (his name) IS A POO POO HEAD! I FILMED HIS SISTER BATHING THEN SENT HIM THE VIDEO WITH A LABEL TELLING HIM HOW TO COMMIT SEPPUKU!" which it pointlessly echoes out to the parallel port too.
Now you know what kind of network admin I used to be... Or do you?
A wussy one because I never installed this, I did show it to my superior though and he found it amusing at least... He wasn't the guy's biggest fan either. We settled for tampering with his internet privileges and moving word documents around remotely so as to annoy him without costing him anything.
Fun times. I wrote something similar to actually prevent other people starting my machine, it didn't mess with files and only stated "Enter Code:" and "YOU BLEW IT!" it reacted to TURNKEY.DXZ by starting the machine up, though really I ran XP on a different drive so I never really had to rely on this thing anyway, just had this one run 98 with the program to stop noobs breaking it when I wasn't there -- both programs can be killed with CTRL+BREAK and be defeated by safe mode, so they would not stop a tech savvy user.
