PC Hell: Smash virus - Windows Blue Screen Virus

Smash Virus Help and Information

What is the SMASH Virus?

This virus launches on the 14th day of the month. As of July 13th, 2000 it has not been found in the wild so the threat is very low. However, the presentation of the virus and the level of destruction warrants discussing the virus. When the current system day is 14 and the month is greater than or equal to 6 (June), the virus activates. The next time the computer starts, the system displays a Windows Blue Screen, commonly referred to as the Blue Screen of Death (BSOD).

This screen contains the following message and hangs the system:

"Virus Warning!
Virus name is 'SMASH', project D version 0x0A.
Created and compiled by Domitor.
Seems like your bad dream comes true..."

The virus uses low-level system calls that are made directly to BIOS memory to activate it.

What damage does the Virus cause?

After the blue screen is displayed, the computer freezes. The SMASH virus preys upon human reactions to activate the virus. The malicious code will only activate once the computer is rebooted after freezing. Since most computer users would press any key or try to reboot the computer after receiving the blue screen, they unwittingly cause the virus to activate.

Since the virus overwrites part of the IO.SYS file, the system hangs upon a reboot and displays the message "Formatting hard disk". It then formats the hard drive destroying all data.

How to Avoid the SMASH Virus

Since the virus is nearly impossible to stop once it has been activated, the only precautions one can take are to update their virus signatures and scan their system regularly. Although it hasn't been seen in the wild and is a low risk virus, the possiblity of a virus attacking a computer in this way has now been proven. So, most likely there will be more viruses of this type in the future.

More Information on the SMASH Virus

Trend Micro information on Smash

ZD Net Virus Alert

McAfee Alert for Smash