Barrotes is a computer virus, considered as the first of Spanish origin,[1][2][3][4] which appeared in December 1992,[5] and was programmed in assembly language for DOS-based systems. Initially, although to a lesser extent, it was also called Toledo by the press,[6][1] due to the location in the homonymous city of its first discovery, and registered as Virus:DOS/Barrotes by Microsoft.[7]
Like many viruses of the time, it remains dormant in the affected machine, waiting for a specific date to execute its malicious code, also called payload, with the date chosen by its developer being 5 January, a very important date in Spain, as it is the night of the Biblical Magi, displaying the message «Virus BARROTES por OSoft» and the on-screen graphics of the characteristic bars that give it its name and make it look like the system is in a prison cell.[8][2][9]
Features
The virus occupies a total of 1310 bytes in size and infects COM and EXE executable files.[8][10] When an infected file is executed on the system, the malicious code of the virus is the first thing to execute, checking if it is already resident in memory, detecting if it has already been executed before, bypassing the infection process of the executed file, otherwise it proceeds to install itself in memory by registering the interrupt vector corresponding to DOS services (int 21) in the virus header, thanks to which the virus will infect files on the system as the user executes them.[8][11]
It will then check if the date is 5 January to display the author's message and the bars, otherwise it runs the system normally, going unnoticed.[8][2]
Propagation method
Barrotes has no automatic method of propagation beyond infecting local files on the machine affected by the virus. Its main method of dissemination, given the context of its time of action —the 90s— was the exchange of infected files via physical storage media, such as floppy disks.[11][12][4]
Variants
Subsequently, new versions and variants of the virus appeared with more pronounced malicious effects, such as the Barrotes 1303 variant in 1996,[13] which destroyed the boot sector of the hard disk, preventing the system from booting and accessing the information stored on it, changing the activation date to 23 September.[12][9][14] Many computer systems were exposed to these effects.[15]
OK PC number 17, 1993, New Publisher Press, S.A., Internet Archive
Virus Bulletin - The International Publication On Computer Virus Prevention, Recognition And Removal, 1994, Network Security Management, UK, ISSN 0956-9979, Internet Archive
This page is based on this Wikipedia article Text is available under the CC BY-SA 4.0 license; additional terms may apply. Images, videos and audio are available under their respective licenses.
