FANDOM


MrsMajor.exe (also known as BossDaMajor.exe) is a scary trojan for Microsoft Windows created by Elektro Berkay.

The trojan received notoriety after Siam Alam made a video about this trojan. It had later had a better version called MrsMajor2.0.exe which was featured in the YouTuber Siam Alam's video too.

Description

MrsMajor, also known as BossDaMajor is Trojan for Microsoft Windows. It originates from Turkey and it was created in 2017.

Strangely enough, even though the virus itself is called MrsMajor, the executable is called bossdamajor.exe.

Version 1.0

After the trojan is executed, it reboots the computer after some seconds. When the computer is loaded, the wallpaper gets changed to skulls of dead humans. It changes all of the file icons to skulls, and adds a lot of files with name "MRS MAJOR WANTS TO MEET YOU". Then it runs the media player with the doll. After this, virus doesn't do anything, except that it makes the user not able to run Task Manager.

Version 2.0

MrsMajorWarningMessage

The warning message that appears before running the virus (2.0 version only)

After the user has run the virus, Windows Media Player is opened and the system has restarted.

Windows Media Player shows a video of the MrsMajor game. the game is a scary maze. it shows a room of the maze with a green tint and then comes a 'scareface'. The wallpaper is later changed to schemes and the icons also to schemes. After it is fully loaded, there is flashing and moving image of a scary doll named "Mrs. Major" on the screen. It changes all of the files' icons to a demon face. Also, it adds a lot of files with the name "HUMANS ARE TASTY". Thresh's Theme from League of Legends, plays in the background after the image appears.

It includes rules. One of the rules tells users to not use Task Manager to end the virus. If the user attempts to open Task Manager, then a message stating "T" will appear. The rules reads as follows:

Note: This is taken from the actual 2.0 version of the malware. Do not modify it.
Your computer has been infected by MrsMajor.
If you dont attend rules, your computer will be "Trash"
Theese are rules:

+If timer runs out, your computer won't work anymore
+If you ATTEMPT to kill any process, your PC will die
+Do NOT delete any virus files.
+Uninstall your antivirusses. They may try to remove virus.
+Do not run Taskmanager, cmd, sethc,
+Do NOT use safe mode.
+Do NOT Remove any registries from msconfig etc..

Or Your PC Will not be able to boot up..

If the user breaks the rules, there will be a RSoD (Red Screen of Death) screen telling the user they broke the rules of the virus. The error code is "TROJANS_NEVER_JOKE_RESPECT_THE_TROJANS", which may be telling the user that this piece of malware is a Trojan. If the user shuts down their PC while the virus is running, the virus will trash the operating system by deleting some boot files. The RSoD screen reads as follows:

Note: This is taken from the actual 2.0 version of the malware. Do not modify it.

A problem has been detected and windows has been shutdown to prevent damage to your computer.

TROJANS_NEVER_JOKE_RESPECT_THE_TROJANS

If this is first time you have seen this screen you are infected by MrsMajor.exe and you broke rules. It is unacceptable. However, your computer wont be able to boot up. Because logonui.exe is missing..

If problems continue, contact the virus owner or disable ur bios memory. Jk second way wont work. Do not waste your time. Everytime you boot up your computer, this screen will appear. If you want to contact virus creator, here is the mail: mskonsol11@gmail.com
Theese are fake technical informations:

*** STOP: 0x00D1 (0x00C,0x002,0x00,0xF86B5A89)
Address F86B5A89 base at F86B5000, DateStamp 3dd9919eb ***

Beginning dump of physical memory..
Physical memory dump complete.

Windows can't reboot. shutdown.exe is missing. Fix your system. Eh, if its possible.

Version 3.0

The Mrs Major rules

The rules of the virus.

In this version, the user will need a code to execute the virus. It's possible to get this code from Berkay himself on his Discord. After it's executed and the code is written, you will get a window "Verified... Wait a few seconds until a new window will appear." After, a window stating this will appear: "Be patient while Mrs. Major infects your system. This usually takes 23 seconds. Do you want to see the screen of rules?" If the user will click "Yeah sure." it will display the rules:

Note: This is taken from the actual 3.0 version of the malware. Do not modify it.
Searching keywords on google such as "antivirus download", "malwarebytes download", "do i have a virus" is not allowed. If you do, you'll get a prompted with a blue screen explaining you why your computer just ran into a crash.
Using 3rd party tools is not allowed. You'll get a BSoD again.
Once the malware runs out of blood, you'll get your LogonUI overwritten. If you fix your LogonUI, you'll get your boot sector overwritten, just like your system32 files. So don't do that ig.
This program can't be ran on a real machine. (VM only)
Have fun!
Elektro Berkay / MoonCon - tobiaddr0c#3158

After 23 seconds user's pc will reboot. After the reboot, user's wallpaper will be changed to a dark night forest. Also, all of the icons change to an image of an eye. Then, the Mrs. Major will appear with the blood counter. (P.S. The blood is being drawn with dwm.exe, so if you kill this process, you will stop the blood counter completely.) This timer actually goes much faster then the timer from the previous version. If the user will try to search the keywords on Google, they will get a BSoD with the error code "CRITICAL_PROCESS_DIED". When the blood runs out, LogonUI.exe will get overwritten. (This actually still doesn't work how author wanted). Also, if the user will fix the LogonUI.exe, your boot sector and system32 files will be actually overwritten. If the user boot after the overwrite, they will get a screen stating this:

Note: This is taken from the actual 3.0 version of the malware. Do not modify it.

"You are not very smart. Are you? The situation of your disk is even worse now"

Media

Community content is available under CC-BY-SA unless otherwise noted.