FANDOM


Virus.DOS.Crucifixion is a memory resident parasitic virus on DOS, it was discovered in January 1995.

There are 3 variants:

  • Virus.DOS.Crucifixion.2888
  • Virus.DOS.Crucifixion.2914
  • Virus.DOS.Crucifixion.2916

BehaviorEdit

When the virus is loaded into memory, it hooks INT 9 and 21h to infect any DOS executable file by writing itself to the end of these files that are created or copied. When a file is being copied, the virus copies its code to both the new copy and the original one.

The virus has a TSR code name of "JeSuS" when it stays memory.

Advanced detailsEdit

Memory usage of the variants:

Variant Memory usage in bytes
Crucifixion.2888 2,912
Crucifixion.2914 2,944
Crucifixion.2916 2,944

MD5 hashes:

Variant Hash
Crucifix.2888 6b54ee829bd7e559130d101a2a0cb841
Crucifix.2914 fa7e62b69305ef793a392844d787762f
Crucifix.2916 0f45ee3b852d78872050103a79eaa655

PayloadEdit

The virus activates on every Sunday during March or April. When the user issues Ctrl-Alt-Del, it activates by displaying an ASCII image of Jesus (animated), plays the tune and displays messages before the machine reboots.

Crucifixion.2888:

LAMER
Copyright (c) Moscow, 1997
It`s a stupid virus, but i like it
Welcome every day in march and april!
Now i`ll show you how its work...

Crucifixion.2914 and 2916:

(rucifixion Virus 1.0
(c) 1994, by Jesus of The Trinity
If you're the Messiah and you know it,
Then your face will surely show it,
Clap your hands!

Other detailsEdit

Crucifixion.2888 is a cracked version of the original variant, released in 1997.

This virus might not be able to run properly under some system hardware configurations.

ReferencesEdit

  1. List of variants of the Crucifixion virus on VX Heaven
  2. Description of the Crucifixion virus on Online VSUM

VideosEdit

Virus.DOS.Crucifixion00:25

Virus.DOS.Crucifixion.2888

Virus.DOS.Crucifixion.2888 on Virtual PC

Ad blocker interference detected!


Wikia is a free-to-use site that makes money from advertising. We have a modified experience for viewers using ad blockers

Wikia is not accessible if you’ve made further modifications. Remove the custom ad blocker rule(s) and the page will load as expected.