| Blackbat | |
|---|---|
| Type | File virus |
| Creator | Rohitab |
| Date Discovered | 1999 |
| Place of Origin | Kurukshetra, India |
| Source Language | Assembly |
| Platform | MS Windows |
| File Type(s) | .exe |
| Infection Length | ~2,800 bytes |
Blackbat is a virus by Rohitab. It appeared in issue 6 of the 29A magazine. Blackbat is a Windows 9x file infector, whose signature is Rohitab's birth date.
Behavior
The virus checks if it is already memory, searching for the value 0AD75h. If WIN.SYS is found in the root of drive C:, it will not become memory resident or infect files. If neither of these conditions exists, the virus becomes memory resident. It infects any Windows Portable Executable by appending itself to the end of a file. Blackbat avoids infecting files with "AV", "AN", and "F-" in their names, effectively preventing it from attacking antivirus products.
On December 8, the virus delivers a payload, displaying the message box "Happy BirthDay :-)".
Origin
Blackbat was written by Rohitab, who published it in issue 6 of 29A magazine. Its copyright date is 1999, but no more specific date was given. In addition, Issue 6 of 29A was released in 2004. Its location of origin is in all likelihood India, as during 1999, Rohitab was in his last semester at Kurukshetra University and later working at DCM Technologies, according to his resume.
Sources
Rohitab. Rohitab.com, BlackBat Virus – Non Destructive.