Fandom

Malware Wiki

Ambulance

1,321pages on
this wiki
Add New Page
Comments0 Share

Virus.DOS.Ambulance is a parasitic virus on DOS.

There are 7 variants:

  • Virus.DOS.Ambulance.793 (B, C and D)
  • Virus.DOS.Ambulance.795
  • Virus.DOS.Ambulance.796 (A, B and C)

BehaviorEdit

When an infected file is executed, it infects one DOS executable in the current directory, however it does not infect the first file, so if there is only one executable file in the same directory, the virus simply does nothing. So there should have at least 2 files in the same directory in order to spread.

PayloadEdit

When an infected file is run, an ASCII ambulance may move across the bottom part of the screen, with siren sound playing from the system speaker.

Ambulance.793Edit

These variants do not manifest themselves.

Ambulance.795, 796.a and 796.bEdit

These variants activate by random.

Ambulance.796.cEdit

This variant always activate before the program execution.

Ambulance796

Ambulance.796 in action

Other detailsEdit

The actual infection size of Ambulance.793 is 796 bytes so that some antiviruses may identify these variants as Ambulance.796 instead.

There is a virus having a similar payload called Hafenstrass, also came from Germany. It features a payload of an ambulance crashing into a wall.

ReferencesEdit

Description of Ambulance, Online VSUM

Description of Hafenstrass, Online VSUM

See alsoEdit

Ambulance_II

VideosEdit

Virus.DOS02:32

Virus.DOS.Ambulance

Ambulance virus review by Alles Sandro

Ad blocker interference detected!


Wikia is a free-to-use site that makes money from advertising. We have a modified experience for viewers using ad blockers

Wikia is not accessible if you’ve made further modifications. Remove the custom ad blocker rule(s) and the page will load as expected.