Fandom

Malware Wiki

Death

1,335pages on
this wiki
Add New Page
Comments0 Share

Virus.DOS.Death is a parasitic virus on DOS.

There are 3 variants:

  • Virus.DOS.Death.638
  • Virus.DOS.Death.725
  • Virus.DOS.Death.1001

Behavior

When the virus is run, it infects a number of DOS executable by writing itself to the end of these files.

Death.638

This variant infects 1 or 2 files on each run, followed by activation. The actual infection size is 1,638 bytes.

Death.725

This is the memory resident variant, it hooks INT 21h to infect any DOS executable that is run.

Programs infected by this virus might not function properly and hang or even crash the system.

Death.1001

This is a both TSR and non-TSR encrypted variant, it infects one file on each run, and it sets the initial generation as 0. It does not infect COMMAND.COM and files that are smaller than 1,000 bytes.

After being TSR, it still infects files in non-TSR way, i.e. run only infected files to spread.

Memory usage

The following table shows the memory usage of the variants.

Variant Memory usage in bytes
Death.638 Non-TSR
Death.725 4,512
Death.1001 736

Payload

Death.638

After infection it displays a rather disturbing ASCII picture of a skull, with some text:

DEATHS HEAD VIRUS

Abandon Hope All Ye
Who Contract Me

The host program will run after that, but usually fails and might cause a system hang.

Death638 payload

The payload of Death.638, followed by the host program.

Death.725

After a non fixed number of infections, the virus would crash the system.

Death.1001

On the 8th generation it displays the message and the host program will not be executed:

Bad command or file name

After that it becomes memory resident and hooks onto INT 9 (keyboard), the virus would use the same name that the program has been run in order to "hide" itself, consuming 736 bytes of memory. However if the host program is also TSR, it would become noticeable when using MEM detailed mode.

Death1001 TSR

The virus uses the name of the host program to stay in memory, but it would be revealed if the host is also TSR.

When the user attempts to reset the computer by issuing CTRL-ALT-DEL, the virus displays the following poetic message and hangs the computer:

Your PC has lapsed into a higher state of being...

D E A T H

Please, feel free to cold boot,
as nothing has been damaged,
it was only a near death
experience

Your PC should meditate more often,
'cuz with all the evil viruses
flowing around neurospace
we wouldn't want this
to become a real

D E A T H

[Death]  The Attitude Adjuster, VG, 12/02/92

Other details

Death.638 contains the internal text string:

????????COM
*.com

Death.725 contains the internal text string:

I`m coming back I will return
Svilena S.
[Death]

Videos

Death DOS Virus01:54

Death DOS Virus

Death virus review by Alles Sandro

Ad blocker interference detected!


Wikia is a free-to-use site that makes money from advertising. We have a modified experience for viewers using ad blockers

Wikia is not accessible if you’ve made further modifications. Remove the custom ad blocker rule(s) and the page will load as expected.