FANDOM


Virus.DOS.Alice or Alice is a virus that runs on MS-DOS.

This virus has 2 versions:

  • Virus.DOS.Alice.490
  • Virus.DOS.Alice.513

Details

Alice is a memory resident parasitic virus. Both variants have the same effect.

When the virus is executed, it becomes memory resident and hooks INT 21. It infects .COM files as they are run, with the exception of COMMAND.COM. It also does not infect files smaller than itself. The virus appends its code to the end of the file to be infected. The file's date and time stamp will change to the current date and time. The amount of bytes free does not decrease, but the user is able to see the file size increase.

Both variants take up 4096 bytes in memory.

Infected files are unable to be recovered and must be deleted.

Payload

On August 11 of any year, when an infected file is run, it displays the following message:

FOR BEAUTIFUL GIRLS!

If you listen Alice Cooper
Then I stuned with you now.
Come my pussy pussy girl,
I want kiss your lipsy now.

(c) Light General.

It then runs the file that the user intended. This message is also visible in plain text in the original file, however it is encrypted within the infected files.