FANDOM


Virus.DOS.TPE.Kela.4568 also known as the Kela-17, is a memory resident parasitic polymorphic TPE-based and encrypted virus on DOS.

Behavior

When the virus is loaded into memory, it first infects C:\COMMAND.COM, followed by hooking INT 21h and infects any executable that is run.

Under CHKDSK the files may appear an allocation error due to their size changes, while it is not observable as long as the virus stays memory resident.

Advanced details

The virus occupies 9,760 bytes when staying memory resident.

MD5 hash:

6540f262aa7cacb651cf892cdd02516f

Payload

When an infected program is run on Friday 13th, it runs itself with a video effect.

Other details

Both of the size of the original sample or that in infected files are not equal to 4,568 bytes, even it is called as TPE.Kela.4568 in alias.

The virus contains the encrypted internal text strings:

[TPE 1.3]
This is KELA-17 version virus.
KELA-17 very nice virus . Ha Ha HaHa
KELA - 17
TPE, KELA. Copyright (c) 1994 by KELA. All Rights Reserved. KELA

See also

Videos

Virus.DOS.TPE

Virus.DOS.TPE.Kela

KELA virus review by danooct1

Virus.DOS.TPE.Kela

Virus.DOS.TPE.Kela.4568

Ad blocker interference detected!


Wikia is a free-to-use site that makes money from advertising. We have a modified experience for viewers using ad blockers

Wikia is not accessible if you’ve made further modifications. Remove the custom ad blocker rule(s) and the page will load as expected.