i have a bunch of viruses which i collected last year when i was under a 9 month internet blackout, propagated only in windows machines without internet access.

i have a bunch of viruses which i collected last year when i was under a 9 month internet blackout, propagated only in windows machines without internet access. at one point, i set up a "xp vm" on my kde neon, loaded an infected file and spend a good day figuring out where it was. turns out this particular virus saves a copy of itself in user/appdata folder in C, then opens a process with that name, "usually newfolder" and once a removable drive was detected, it would 1, move all contents into a " " folder (yes. a folder named as a single space, then put that folder as system hidden folder so that it gets hidden (and only visible if going into folder settings, show system files) then create new shortcuts to all old files which did 2 things, one, symlink style open that particular file and more importantly, copy the virus executable to the current system if not already present. it was a fun exercise. i had told a colleague, "either this virus survives today or i will". oh, there was one downside to another strain of this virus. if i deleted the autorun file, it would go ahead and delete the entire removable drive data. that was PITA the only reason this virus and similar others propagated so wildly during that time was because there was no internet and windows as far as i know, "expects" 24x7 internet connectivity