FANDOM


Virus.DOS.Bad.389 is a memory resident parasitic DOS virus.

Payload

When the virus is loaded into memory, it hooks INT 21h to infect any DOS executable file that is run. The timestamp of the infected file will be changed to the time of infection. It has a VirusTotal detection rate of 36/58.

Advanced details

The virus occupies 624 bytes of memory when it stays resident.

MD5 hash:

268889c4897d1ad65ef907905827a65b


SHA-256:


233632d8044db2c3988e26ee08f2644d0363f5512b6f709000c881cd309d5821

Payload

After system starts up, the virus outputs a message without running the host program by the time the first infected program is run:

Bad command or file name

The user may run the program normally afterwards since it shows once only in every section.

Other details

The virus contains the internal text string:

Bad command or file name

Videos

Virus.DOS.Bad

Virus.DOS.Bad.389

Virus.DOS.Bad.389