Brain (computer virus)
Encyclopedia
Brain is the industry standard name for a computer virus that was released in its first form in January 1986, and is considered to be the first computer virus
for MS-DOS
. It infects the boot sector
of storage media formatted with the DOS
File Allocation Table
(FAT) file system.
There are many minor and major variations to that version of the text. The virus slows down the floppy disk
drive and makes seven kilobytes of memory unavailable to DOS. Brain was written by two brothers, Basit and Amjad Iqbal, who at the time lived in Chahmiran, near Lahore Railway Station
, in Lahore
, Pakistan
. The brothers told TIME
magazine they had written it to protect their medical software from piracy, and it was supposed to target copyright infringers only. The cryptic message "Welcome to the Dungeon", a safeguard and reference to an early programming forum on Dungeon BBS, appeared after a year because the brothers licensed a beta version of the code. The brothers could not be contacted to receive the final release of this version of the program. (see Author Response)
Brain lacks code for dealing with hard disk
partitioning
, and avoids infecting hard disks by checking the most significant bit of the BIOS drive number being accessed. Brain does not infect the disk if the bit is clear, unlike other viruses at the time, which paid no attention to disk partitioning and consequentially destroyed data stored on hard disks by treating them in the same way as floppy disks. Brain often went undetected, partially due to this deliberate non-destructiveness, especially when the user paid little to no attention to the slow speed of floppy disk access.
The virus came complete with the brothers' address and three phone numbers, and a message that told the user that their machine was infected and to call them for inoculation:
This program was originally used to track a heart monitoring program for the IBM PC, and pirates were distributing bad copies of the disks. This tracking program was supposed to stop and track illegal copies of the disk. Unfortunately, the program also sometimes used the last 5k on an apple floppy, making additional saves to the disk by other programs impossible.
, United Kingdom
and elsewhere, demanding them to disinfect their machines, they were stunned and tried to explain to the outraged callers that their motivation had not been malicious. Their phone lines were over loaded. The brothers are still in business in Pakistan as Brain NET Internet service providers with a company called Brain Telecommunication Limited.
In 2011, 25 years after Brain was released, Mikko Hyppönen
of F-Secure
travelled to Pakistan to interview Basit and Amjad for a documentary. Being inspired by this documentary and its widespread, a group of Pakistani bloggers interviewed Amjad, under the banner of Bloggerine.
Computer virus
A computer virus is a computer program that can replicate itself and spread from one computer to another. The term "virus" is also commonly but erroneously used to refer to other types of malware, including but not limited to adware and spyware programs that do not have the reproductive ability...
for MS-DOS
MS-DOS
MS-DOS is an operating system for x86-based personal computers. It was the most commonly used member of the DOS family of operating systems, and was the main operating system for IBM PC compatible personal computers during the 1980s to the mid 1990s, until it was gradually superseded by operating...
. It infects the boot sector
Boot sector
A boot sector or boot block is a region of a hard disk, floppy disk, optical disc, or other data storage device that contains machine code to be loaded into random-access memory by a computer system's built-in firmware...
of storage media formatted with the DOS
DOS
DOS, short for "Disk Operating System", is an acronym for several closely related operating systems that dominated the IBM PC compatible market between 1981 and 1995, or until about 2000 if one includes the partially DOS-based Microsoft Windows versions 95, 98, and Millennium Edition.Related...
File Allocation Table
File Allocation Table
File Allocation Table is a computer file system architecture now widely used on many computer systems and most memory cards, such as those used with digital cameras. FAT file systems are commonly found on floppy disks, flash memory cards, digital cameras, and many other portable devices because of...
(FAT) file system.
Description
Brain affects the IBM PC computer by replacing the boot sector of a floppy disk with a copy of the virus. The real boot sector is moved to another sector and marked as bad. Infected disks usually have five kilobytes of bad sectors. The disk label is changed to ©Brain, and the following text can be seen in infected boot sectors:- Welcome to the Dungeon (c) 1986 Brain & Amjads (pvt) Ltd VIRUS_SHOE RECORD V9.0 Dedicated to the dynamic memories of millions of viruses who are no longer with us today - Thanks GOODNESS!! BEWARE OF THE er..VIRUS : this program is catching program follows after these messages....$#@%$@!!
There are many minor and major variations to that version of the text. The virus slows down the floppy disk
Floppy disk
A floppy disk is a disk storage medium composed of a disk of thin and flexible magnetic storage medium, sealed in a rectangular plastic carrier lined with fabric that removes dust particles...
drive and makes seven kilobytes of memory unavailable to DOS. Brain was written by two brothers, Basit and Amjad Iqbal, who at the time lived in Chahmiran, near Lahore Railway Station
Lahore Railway Station
The Lahore Railway Station in Lahore, Punjab, Pakistan was built by British colonists between 1859-1860 at the cost of half a million Rupees. It is of typical grand British architecture in South Asia during the British Raj period...
, in Lahore
Lahore
Lahore is the capital of the Pakistani province of Punjab and the second largest city in the country. With a rich and fabulous history dating back to over a thousand years ago, Lahore is no doubt Pakistan's cultural capital. One of the most densely populated cities in the world, Lahore remains a...
, Pakistan
Pakistan
Pakistan , officially the Islamic Republic of Pakistan is a sovereign state in South Asia. It has a coastline along the Arabian Sea and the Gulf of Oman in the south and is bordered by Afghanistan and Iran in the west, India in the east and China in the far northeast. In the north, Tajikistan...
. The brothers told TIME
Time (magazine)
Time is an American news magazine. A European edition is published from London. Time Europe covers the Middle East, Africa and, since 2003, Latin America. An Asian edition is based in Hong Kong...
magazine they had written it to protect their medical software from piracy, and it was supposed to target copyright infringers only. The cryptic message "Welcome to the Dungeon", a safeguard and reference to an early programming forum on Dungeon BBS, appeared after a year because the brothers licensed a beta version of the code. The brothers could not be contacted to receive the final release of this version of the program. (see Author Response)
Brain lacks code for dealing with hard disk
Hard disk
A hard disk drive is a non-volatile, random access digital magnetic data storage device. It features rotating rigid platters on a motor-driven spindle within a protective enclosure. Data is magnetically read from and written to the platter by read/write heads that float on a film of air above the...
partitioning
Disk partitioning
Disk partitioning is the act of dividing a hard disk drive into multiple logical storage units referred to as partitions, to treat one physical disk drive as if it were multiple disks. Partitions are also termed "slices" for operating systems based on BSD, Solaris or GNU Hurd...
, and avoids infecting hard disks by checking the most significant bit of the BIOS drive number being accessed. Brain does not infect the disk if the bit is clear, unlike other viruses at the time, which paid no attention to disk partitioning and consequentially destroyed data stored on hard disks by treating them in the same way as floppy disks. Brain often went undetected, partially due to this deliberate non-destructiveness, especially when the user paid little to no attention to the slow speed of floppy disk access.
The virus came complete with the brothers' address and three phone numbers, and a message that told the user that their machine was infected and to call them for inoculation:
- Welcome to the Dungeon © 1986 Basit * Amjad (pvt) Ltd. BRAIN COMPUTER SERVICES 730 NIZAM BLOCK ALLAMA IQBAL TOWN LAHORE-PAKISTAN PHONE: 430791,443248,280530. Beware of this VIRUS.... Contact us for vaccination...
This program was originally used to track a heart monitoring program for the IBM PC, and pirates were distributing bad copies of the disks. This tracking program was supposed to stop and track illegal copies of the disk. Unfortunately, the program also sometimes used the last 5k on an apple floppy, making additional saves to the disk by other programs impossible.
Author response
When the brothers began to receive a large number of phone calls from people in United StatesUnited States
The United States of America is a federal constitutional republic comprising fifty states and a federal district...
, United Kingdom
United Kingdom
The United Kingdom of Great Britain and Northern IrelandIn the United Kingdom and Dependencies, other languages have been officially recognised as legitimate autochthonous languages under the European Charter for Regional or Minority Languages...
and elsewhere, demanding them to disinfect their machines, they were stunned and tried to explain to the outraged callers that their motivation had not been malicious. Their phone lines were over loaded. The brothers are still in business in Pakistan as Brain NET Internet service providers with a company called Brain Telecommunication Limited.
In 2011, 25 years after Brain was released, Mikko Hyppönen
Mikko Hyppönen
Mikko Hermanni Hyppönen is a computer security expert and columnist.-Career:Mikko Hyppönen is the Chief Research Officer for F-Secure. He has worked with F-Secure in Finland since 1991....
of F-Secure
F-Secure
F-Secure Corporation is an anti-virus and computer security software company based in Helsinki, Finland. The company has 18 country offices and a presence in more than 100 countries, with Security Lab operations in Helsinki, Finland and in Kuala Lumpur, Malaysia...
travelled to Pakistan to interview Basit and Amjad for a documentary. Being inspired by this documentary and its widespread, a group of Pakistani bloggers interviewed Amjad, under the banner of Bloggerine.
Variants
Ashar is an older version of Brain. There are six variants each with a different message.See also
- Notable computer viruses and wormsTimeline of notable computer viruses and wormsThis is a timeline of noteworthy computer viruses, worms and Trojan horses.- 1966 :* The work of John von Neumann on the "Theory of self-reproducing automata" is published...
- RootkitRootkitA rootkit is software that enables continued privileged access to a computer while actively hiding its presence from administrators by subverting standard operating system functionality or other applications...
- Iqbal Town, LahoreIqbal Town, LahoreIqbal Town is a commercial and residential locality in the south-western Lahore. It is named after Allama Iqbal, the national poet of Pakistan. Development was started in the late 1970s and early 1980s. It was previously famed for its name in Urdu, 'Sola Soo Acre سولہ سو ایکڑ' , due to its area...