There are 7 variants:
- Virus.DOS.Ambulance.793 (B, C and D)
- Virus.DOS.Ambulance.796 (A, B and C)
When an infected file is executed, it infects one DOS executable in the current directory, however it does not infect the first file, so if there is only one executable file in the same directory, the virus simply does nothing. So there should have at least 2 files in the same directory in order to spread.
This is a non-memory resident virus, it leaves nothing in memory after execution.
When an infected file is run, an ASCII ambulance may move across the bottom part of the screen, with siren sound playing from the system speaker.
These variants do not manifest themselves.
Ambulance.795, 796.a and 796.b
These variants activate by random.
This variant always activates before the program execution.
The actual infection size of Ambulance.793 is 796 bytes so that some antiviruses may identify these variants as Ambulance.796 instead.
There is a virus having a similar payload called Hafenstrass, also came from Germany. It features a payload of an ambulance crashing into a wall.
- Description of Ambulance on Online VSUM
- List of variants of the Ambulance virus on VX Heaven
- Description of Hafenstrass on Online VSUM