Virus Encyclopedia
Welcome to the Virus Encyclopedia of Panda Security.
Barrotes | |
Threat Level Damage Distribution |
At a glance
 |
| Common name: | Barrotes |
| Technical name: | Barrotes.1310.A |
| Threat level: | Low |
| Type: | Virus |
| Effects: | It infects files with an EXE or COM extension. Depending on the system date, it displays several vertical bars on screen.
|
| Affected platforms:
| MS-DOS |
| Detection updated on: | Jan. 20, 2008 |
| Statistics | No |
| Country of origin: | SPAIN |
Brief Description | |
Barrotes is a resident virus that goes memory resident every time the computer is started up. It is easy to identify this virus because it displays several vertical lines which change color on screen.
Barrotes is considered dangerous because it infects files with EXE and COM extensions. It can even overwrite the Master Boot Record of the hard disk, thereby preventing the user from accessing the hard disk of the computer infected by this virus.
|
Visible Symptoms | |
After Barrotes has infected the computer, several symptoms can be noticed:
Firstly, Barrotes checks the system date. If this date is January 5 of any year, it displays several vertical lines which change color on screen.
At the top of the screen it displays the following text: Virus BARROTES por OSOFT.
|
Tech details
Effects |
| On January 5 Barrotes activates and carries out the following effects: |
- It displays several vertical bars which change color on screen.
- It overwrites the Master Boot Record of the hard disk. As a result, the user will not be able to access the hard disk of the computer infected by this virus.
- Barrotes infects the files with EXE and COM extensions that are run, including the COMMAND.COM file.
- Barrotes goes memory resident in order to ensure it is loaded every time the computer is started up
Infection strategy
In order to carry out its infection, Barrotes follows the routine below:
Barrotes modifies the following files:
- Files with EXE and COM extensions.
- COMMAND.COM, which is found in the root directory. It modifies this file in order to ensure that it is loaded in memory when the operating system is run. When an infected file is run, the virus goes memory resident and intercepts programs with COM and EXE extension when they are accessed or run. In order to do this, the virus intercepts the interrupt 21h.
Barrotes also overwrites the Master Boot Record of the hard disk. As a result, users will not be able to access the hard disk.
Means of transmission
Barrotes does not use any specific means to spread. It can reach computers through the usual means used by viruses: CD-ROMs, e-mail messages with infected attachments, computer networks, Internet downloads, FTP, floppy disks, etc.
