Madoka.exe: Difference between revisions

Line 7:

|image = Madoka.png

|maker = Qiwen Lin

|type = Application

|type = [[Application]]

|date = 2001

|imagecaption = The '''Madoka.exe''' icon.

}}

'''Madoka.exe''', also known as the '''Ghost virus''' or the '''Sadako virus''' in Japan, was a Taiwanese [[screamer]] program, which is a variant of the Win32/FlaGhost Malware. The original author is Qiwen Lin (林啟文), and it's written in Hot Soup Processor programming language.

'''Madoka.exe''', also known as the '''Ghost virus''' or the '''Sadako virus''' in Japan, was a Taiwanese [[screamer]] [[program]], which is a variant of the Win32/FlaGhost Malware. The original author is Qiwen Lin (林啟文), and it's written in Hot Soup Processor programming language.

== Payload ==

When the user runs the malware by executing the EXE directly, a picture of an Asian woman in full screen is displayed along with the "introduce dialogue" Chinese text showing line by line in the upper-left corner of the screen. However, a ghost version of the woman in the image will appear briefly along with a scream sound effect, before immediately returning to the original image.

When the user runs the malware by executing the [[.exe|EXE]] directly, a picture of an Asian woman in full screen is displayed along with the "introduce dialogue" Chinese text showing line by line in the upper-left corner of the screen. However, a ghost version of the woman in the image will appear briefly along with a scream sound effect, before immediately returning to the original image.

Before showing the initial payload, the malware will copy itself to Windows directory as ''ozawa.exe'' and try to append itself to ''win.ini'' in order to auto start with the OS. Judging from the decompiled source code, this only works on Win98/ME. On XP or higher, there is no ''Run'' section in ''win.ini'' and the malware would not work apart from the initial payload.

Before showing the initial payload, the malware will copy itself to Windows directory as ''ozawa.exe'' and try to append itself to ''win.ini'' in order to auto start with the OS. Judging from the decompiled source code, this only works on [[wikipedia:Windows 98|Win98]]/[[wikipedia:Windows ME|ME]]. On XP or higher, there is no ''Run'' section in ''win.ini'' and the malware would not work apart from the initial payload.

If the malware is launched from the system directory with ''ozawa.exe'' as the name (either from auto start or double click manually in system directory), it will enter "reside mode" without showing the initial payload with the normal woman picture. Instead, it runs in background. It will then show the screamer image along with the scream sound effect indefinitely in the following interval: 3 minutes, 10 minutes, 30 minutes, 60 minutes, 60 minutes, 60 minutes ...

Madoka.exe: Difference between revisions

Navigation menu

Personal tools

Namespaces

Variants

Views

More

Search

Navigation

Community

Screamer Library

Tools

@@ Line 7: / Line 7: @@
 |image = Madoka.png
 |maker = Qiwen Lin
-|type = Application
+|type = [[Application]]
 |date = 2001
 |imagecaption = The '''Madoka.exe''' icon.
 }}
-'''Madoka.exe''', also known as the '''Ghost virus''' or the '''Sadako virus''' in Japan, was a Taiwanese [[screamer]] program, which is a variant of the Win32/FlaGhost Malware. The original author is Qiwen Lin (林 啟文), and it's written in Hot Soup Processor programming language.
+'''Madoka.exe''', also known as the '''Ghost virus''' or the '''Sadako virus''' in Japan, was a Taiwanese [[screamer]] [[program]], which is a variant of the Win32/FlaGhost Malware. The original author is Qiwen Lin (林 啟文), and it's written in Hot Soup Processor programming language.
 == Payload ==
-When the user runs the malware by executing the EXE directly, a picture of an Asian woman in full screen is displayed along with the "introduce dialogue" Chinese text showing line by line in the upper-left corner of the screen. However, a ghost version of the woman in the image will appear briefly along with a scream sound effect, before immediately returning to the original image.
+When the user runs the malware by executing the [[.exe|EXE]] directly, a picture of an Asian woman in full screen is displayed along with the "introduce dialogue" Chinese text showing line by line in the upper-left corner of the screen. However, a ghost version of the woman in the image will appear briefly along with a scream sound effect, before immediately returning to the original image.
-Before showing the initial payload, the malware will copy itself to Windows directory as ''ozawa.exe'' and try to append itself to ''win.ini'' in order to auto start with the OS. Judging from the decompiled source code, this only works on Win98/ME. On XP or higher, there is no ''Run'' section in ''win.ini'' and the malware would not work apart from the initial payload.
+Before showing the initial payload, the malware will copy itself to Windows directory as ''ozawa.exe'' and try to append itself to ''win.ini'' in order to auto start with the OS. Judging from the decompiled source code, this only works on [[wikipedia:Windows 98|Win98]]/[[wikipedia:Windows ME|ME]]. On XP or higher, there is no ''Run'' section in ''win.ini'' and the malware would not work apart from the initial payload.
 If the malware is launched from the system directory with ''ozawa.exe'' as the name (either from auto start or double click manually in system directory), it will enter "reside mode" without showing the initial payload with the normal woman picture. Instead, it runs in background. It will then show the screamer image along with the scream sound effect indefinitely in the following interval: 3 minutes, 10 minutes, 30 minutes, 60 minutes, 60 minutes, 60 minutes ...