FANDOM


Virus.DOS.Ambulance is a parasitic virus on DOS.

There are 7 variants:

  • Virus.DOS.Ambulance.793 (B, C and D)
  • Virus.DOS.Ambulance.795
  • Virus.DOS.Ambulance.796 (A, B and C)

BehaviorEdit

When an infected file is executed, it infects one DOS executable in the current directory, however it does not infect the first file, so if there is only one executable file in the same directory, the virus simply does nothing. So there should have at least 2 files in the same directory in order to spread.

Advanced detailsEdit

This is a non-memory resident virus, it leaves nothing in memory after execution.

MD5 hashes:

Variant Hash
Ambulance.793.b ddca15375ac3382a27b3eb5235d5e289
Ambulance.793.c 21fa0aecdefadaf20ea2e24863b0ec6e
Ambulance.793.d 5c5909807e635fa88b344ff9c699594a
Ambulance.795 a98e1bf21425ae29afd0f8006c482e62
Ambulance.796.a d0bfeaaa6fda8ba6c5c9048859e21193
Ambulance.796.b 4d7802315b219b2bf0049ee98848d9fd
Ambulance.796.c 6ab58dc1f9a8701f666ada749aae70c2

PayloadEdit

When an infected file is run, an ASCII ambulance may move across the bottom part of the screen, with siren sound playing from the system speaker.

Ambulance.793Edit

These variants do not manifest themselves.

Ambulance.795, 796.a and 796.bEdit

These variants activate by random.

Ambulance.796.cEdit

This variant always activates before the program execution.

Ambulance796

Ambulance.796 in action

Other detailsEdit

The actual infection size of Ambulance.793 is 796 bytes so that some antiviruses may identify these variants as Ambulance.796 instead.

There is a virus having a similar payload called Hafenstrass, also came from Germany. It features a payload of an ambulance crashing into a wall.

ReferencesEdit

  1. Description of Ambulance on Online VSUM
  2. List of variants of the Ambulance virus on VX Heaven
  3. Description of Hafenstrass on Online VSUM

See alsoEdit

VideosEdit

Virus.DOS02:32

Virus.DOS.Ambulance

Ambulance virus review by Alles Sandro

Ad blocker interference detected!


Wikia is a free-to-use site that makes money from advertising. We have a modified experience for viewers using ad blockers

Wikia is not accessible if you’ve made further modifications. Remove the custom ad blocker rule(s) and the page will load as expected.