FANDOM


Virus.DOS.Hydra is a memory resident parasitic virus on DOS.

There are 2 variants:

  • Virus.DOS.Hydra.1162
  • Virus.DOS.Hydra.1649

BehaviorEdit

When the virus is loaded into memory, the virus infects EXE executables that are run. The infection size varies in different files.

Hydra.1162Edit

This variant mainly infects goat files, and not every file could be infected by this variant. And it might crash the system on infecting files having specified file size.

Hydra.1649Edit

This variant infects every file that is run, but it does not infect files smaller than 1,000 bytes.

Advanced detailsEdit

The following table shows the TSR memory usage of the variants.

Variant Memory usage in bytes
Hydra.1162 1,504
Hydra.1649 1,984

MD5 hashes:

Variant Hash
Hydra.1162 aac172d12959770758fa4abf3d9fe9d2
Hydra.1649 895de923868f83baa214976f604270ff

PayloadEdit

Hydra activates on January 1st, the payload runs once only on every section.

Hydra.1162Edit

This variant displays the following message:

This is Hydra v1.0.
Don`t panic, I will not destroy your data.

Hydra.1649Edit

When an infected program is run, the virus scrambles characters on screen like inside a washing machine, and they move away to right when a key is pressed.

After that it displays the following message:

This is Hydra v1.1.
Don`t panic, I will not destroy your data.
Hydra1649

Hydra.1649 in action

Other detailsEdit

When an infected goat file is run on non-activation day, the system may crash by memory allocation error or run into an invalid part of memory.

ReferencesEdit

  1. Variants of Hydra on VX Heaven

Ad blocker interference detected!


Wikia is a free-to-use site that makes money from advertising. We have a modified experience for viewers using ad blockers

Wikia is not accessible if you’ve made further modifications. Remove the custom ad blocker rule(s) and the page will load as expected.