FANDOM


Virus.DOS.Abraxas.Cleton is a dangerous file overwriting virus on DOS. This is a sub-variant of the Abraxas family.

There are 2 variants:

  • Virus.DOS.Abraxas.Cleton.1508
  • Virus.DOS.Abraxas.Cleton.1518

BehaviorEdit

When the virus is run, it activates, followed by overwriting the first EXE executable, and makes a copy of this infect file to the parent directory. It also overwrites an DOS executable.

Abraxas.Cleton.1508Edit

This variant overwrites ROMMAND.COM located in parent directory, if no such file exists, the virus creates it.

After an infection, the virus changes the current directory to one upper level.

Abraxas.Cleton.1518Edit

This variant tries to overwite C:\COMMAND.COM instead, but due to some programming faults, it fails and terminates. This also makes the upcoming commands of copying the infected EXE file and changing the current directory to one upper level not to run.

PayloadEdit

The virus plays a tune and display a full screen message in ASCII art:

I am THE
EDWIn CLETOn
VIRUS...

AnD I LOVE A
GOOD "HARD"
DRIVE

And also a text message belows it:

...Ahhhh! Get a ROD just thinking about it!

The ASCII art of "EDWIN CLETON" and the quote have the flashing effect.

Other detailsEdit

All of these variants contain the internal text strings:

*.exe
..
CES (c) Controlled Environment Simulator Edwin Cleton 1993 VirSoft (c)

Abraxas.Cleton.1508 also contains the internal text strings:

rommand.com
Darkest Avenger

Abraxas.Cleton.1518 also contains the internal text strings:

c:\command.com
Glenn Jordon - VirexPC

ReferencesEdit

  1. Index of Abraxas.Cleton on VX Heaven

See alsoEdit

Ad blocker interference detected!


Wikia is a free-to-use site that makes money from advertising. We have a modified experience for viewers using ad blockers

Wikia is not accessible if you’ve made further modifications. Remove the custom ad blocker rule(s) and the page will load as expected.