FANDOM


Virus.DOS.Pro-Alife is a virus that runs on MS-DOS.

There are 3 variants:

  • Virus.DOS.Pro-Alife.3421
  • Virus.DOS.Pro-Alife.3423
  • Virus.DOS.Pro-Alife.3423.b

Behavior

When the virus is loaded into memory, it hooks onto INT 21h and writes itself to the end of .EXE files that are executed. When a program is terminated, it displays one of the messages:

Kill an evil satanic ANTI-VIRAL product for Jesus today!
Stop Disinfectants NOW!
Ain't aLife A Beautiful Choice?
And God Said, "Let There Be Life!", and there was.....
Save the Viruses!  They're People Too!!!!
PRO-aLIFE and PROUD!  STOP THE VIRUS KILLERS! HALT THE AV!
STORM THE COMPU-CLINICS!  DON'T LET THEM KILL THE VIRUSES!!!
Operation Rescue-II, Save the HELPLESS UNBORN Viruses!!!

Advanced details

Variant Memory usage in bytes
Pro-Alife.3421 4,096
Pro-Alife.3423(以及B) 4,096

MD5 hashes:

Variant Hash
Pro-Alife.3421 2de574b21fbd546eea7013c4a02770ab
Pro-Alife.3423 21822f92fad61f00c185dbbdc641fe94
Pro-Alife.3423.b 5cc3f92db01bf9bbbc2dfea62a562543

Payload

When the anti-virus programs are executed:

F-PROT.EXE TBSCAN.EXE TBAV.EXE TBCLEAN.EXE SCAN.EXE CLEAN.EXE VIRSTOP.EXE
MSAV.EXE VSAFE.EXE CPAV.EXE FSP.EXE VDEFEND.EXE

The virus overwrites them with the trojan program that displays being executed:

Eddie Lives, Somewhere in time!  ____________      1704     Jerusalem
Casino  :( ;( =(  Smeg off!      _____ ____  \   Frodo Lives!  APRIL FOOLS!
Get a late pass!    Datacrime    _______________        Brain   Void-Poem
Your PC is now STONED!           __ OO _____ O _  Copy me, I want to travel!
1,000,000,000 Viruses DIED Today!
And yesterday, and more will die tomorrow!
_/\_STOP THE KILLING!_/\_
Look What You're Doing To Them!
Below is an aborted virus... Support PRO-aLIFE Activism!
This program has been TERMINATED by the Virus Survival Underground Movement.
It had long stood as a horrible BABY VIRUS KILLER, and had to be removed.
Life, What a Beautiful Choice (tm).
--==___[OPERATION RESCUE II - SAVING THE BABY VIRUSES!]___==--
Thank you for choosing life over destruction.
Have a Nice Day (tm).

Other details

Virus.DOS.JTTP is a modification of Pro-Alife.3423.b, while it contains different codes of the payload.

Videos

Virus.DOS

Virus.DOS.Pro-Alife

Pro-Alife virus review by Alles Sandro

Pro-Alife DOS Virus

Pro-Alife DOS Virus

Pro-Alife virus review by danooct1