Fandom

Malware Wiki

Cleton

1,345pages on
this wiki
Add New Page
Comments0 Share

Virus.DOS.Abraxas.Cleton is a dangerous file overwriting virus on DOS. This is a sub-variant of the Abraxas family.

There are 2 variants:

  • Virus.DOS.Abraxas.Cleton.1508
  • Virus.DOS.Abraxas.Cleton.1518

Behavior

When the virus is run, it activates, followed by overwriting the first EXE executable, and makes a copy of this infect file to the parent directory. It also overwrites an DOS executable.

Abraxas.Cleton.1508

This variant overwrites ROMMAND.COM located in parent directory, if no such file exists, the virus creates it.

After an infection, the virus changes the current directory to one upper level.

Abraxas.Cleton.1518

This variant tries to overwite C:\COMMAND.COM instead, but due to some programming faults, it fails and terminates. This also makes the upcoming commands of copying the infected EXE file and changing the current directory to one upper level not to run.

Payload

The virus plays a tune and display a full screen message in ASCII art:

I am THE
EDWIn CLETOn
VIRUS...

AnD I LOVE A
GOOD "HARD"
DRIVE

And also a text message belows it:

...Ahhhh! Get a ROD just thinking about it!

The ASCII art of "EDWIN CLETON" and the quote have the flashing effect.

Other details

All of these variants contain the internal text strings:

*.exe
..
CES (c) Controlled Environment Simulator Edwin Cleton 1993 VirSoft (c)

Abraxas.Cleton.1508 also contains the internal text strings:

rommand.com
Darkest Avenger

Abraxas.Cleton.1518 also contains the internal text strings:

c:\command.com
Glenn Jordon - VirexPC

See also

Abraxas

Ad blocker interference detected!


Wikia is a free-to-use site that makes money from advertising. We have a modified experience for viewers using ad blockers

Wikia is not accessible if you’ve made further modifications. Remove the custom ad blocker rule(s) and the page will load as expected.