FANDOM


Virus.DOS.HLLC.Nazi.4752 is a file companion virus on DOS, which is written in high-level programming language.

BehaviorEdit

When the virus is running, it searches for every MZ executable file, and then copies itself and rename as the filename that it searched for, in COM format.

The companion files always have a size of 4,752 bytes, and the timestamp of the new files are the same as that from the source.

The virus ignores the programs that already had a companion file.

Advanced detailsEdit

The virus does not stay memory resident after execution.

MD5 hash:

d7b08ef240ba743fe164af983156c508

PayloadEdit

For any companion file dropped by the virus, if the EXE file sharing the same filename has been moved, deleted or simply not exist, running this file will output a message, and search for any new programs that have no companion file to copy:

Guest by Dirty Nazi/SGWW. 4 PVT only!

Plus some unreadable characters.

Other detailsEdit

The virus contains the internal text strings:

COMSPEC
/C COPY /B
.EXE COMSPEC
/C

See alsoEdit

Ad blocker interference detected!


Wikia is a free-to-use site that makes money from advertising. We have a modified experience for viewers using ad blockers

Wikia is not accessible if you’ve made further modifications. Remove the custom ad blocker rule(s) and the page will load as expected.