This article is about the first version of Ambulance. For the second version, see Ambulance_II.

Virus.DOS.Ambulance is a parasitic virus on DOS.[1]

There are 7 variants:

  • Virus.DOS.Ambulance.793 (B, C and D)
  • Virus.DOS.Ambulance.795
  • Virus.DOS.Ambulance.796 (A, B and C)


When an infected file is executed, it infects one DOS executable in the current directory, however it does not infect the first file, so if there is only one executable file in the same directory, the virus simply does nothing. So there should have at least 2 files in the same directory in order to spread.

Advanced details

This is a non-memory resident virus, it leaves nothing in memory after execution.

MD5 hashes:

Variant Hash
Ambulance.793.b ddca15375ac3382a27b3eb5235d5e289
Ambulance.793.c 21fa0aecdefadaf20ea2e24863b0ec6e
Ambulance.793.d 5c5909807e635fa88b344ff9c699594a
Ambulance.795 a98e1bf21425ae29afd0f8006c482e62
Ambulance.796.a d0bfeaaa6fda8ba6c5c9048859e21193
Ambulance.796.b 4d7802315b219b2bf0049ee98848d9fd
Ambulance.796.c 6ab58dc1f9a8701f666ada749aae70c2


When an infected file is run, an ASCII ambulance may move across the bottom part of the screen, with siren sound playing from the system speaker.


These variants do not manifest themselves.

Ambulance.795, 796.a and 796.b

These variants activate by random.


This variant always activates before the program execution.


Ambulance.796 in action

Other details

The actual infection size of Ambulance.793 is 796 bytes so that some antiviruses may identify these variants as Ambulance.796 instead.

There is a virus with a similar payload called Hafenstrass, which also comes from Germany. It features a payload of an ambulance crashing into a wall.[2]

See also




Ambulance virus review by Alles Sandro