FANDOM


Virus.DOS.7son is a parasitic virus on DOS.

There are 18 variants in 3 versions, represented by the following:

  • Virus.DOS.7son.271
  • Virus.DOS.7son.284.a
  • Virus.DOS.7son.440

Behavior

7son.271

When the virus is run, it infects every DOS executable file in current directory.

7son.284, 286...333.b, 334 and 350

These variants infects every DOS executable file in current directory except those having the size smaller than or equal to 1,000 bytes.

7son.440

This variant infects every DOS executable in current directory, followed by running into an invalid opcode, which would hang the system or the process to be killed (DOS 7.1).

Every time an infected file is run, a memory dump file is placed in root directory, having a random filename and no extension.

All these variants cannot infect files that are larger than 64KB.

Advanced details

These are non memory resident viruses.

MD5 hashes:

Variant Hash
7son.271 875cd8895d558b4cb9366d434250d82b
7son.284.a 6bacb88a242312208bf35f821f2f9a4a
7son.284.b 0cc8417c5779a383f922af76db1bc642
7son.284.d f6cdbb2aabdb7270c3518380e8343a27
7son.284.e e73b6c2c2fd89bef79dcf349eeca797f
7son.286 3152b368ffd5af947beb743be06476f0
7son.327 7f1c2a5a721ac2b61811810a0adc021f
7son.331 23036f459d9f85b5dcd51cb38fe2519c
7son.332 5e01fca94aaf861e52b096d102e54342
7son.332.b 7aaa35ebb1aefd615e8a165ddcafcca6
7son.332.c 727f91a7b73686295ff6214feb96ab69
7son.333.a f2db12bd0fb3c1ea712bb660c25ca8b0
7son.333.b f980bcb349e2a81455980389b14ac676
7son.333.c 54497c13298320707c2e109119b4904c
7son.334 db516862b3b3a15a8daf0426adcaf0d3
7son.344 22963eb8c5b836a0cb414db917dc90c5
7son.350 e49c13d6b953dc6cca566b9f4c76479a
7son.440 6233e8f4925bbc8acb1f721a2cd8aa62

Variants

This family has 18 variants in total:

  • Virus.DOS.7son.271
  • Virus.DOS.7son.284 (A, B, D and E)
  • Virus.DOS.7son.286
  • Virus.DOS.7son.327
  • Virus.DOS.7son.331
  • Virus.DOS.7son.332 (plus B and C)
  • Virus.DOS.7son.333 (A, B and C)
  • Virus.DOS.7son.334
  • Virus.DOS.7son.344
  • Virus.DOS.7son.350
  • Virus.DOS.7son.440

Other details

There are no valid samples for 7son.333.c and 344 but the non-runnable joke programs, while some of the antiviruses still identified them as variants of 7son.

The virus contains the internal text string:

Seventh son of a seventh son
*.COM

References

  1. List of variants of the 7son virus on VX Heaven