Fandom

Malware Wiki

Pro-Alife

1,328pages on
this wiki
Add New Page
Comment1 Share

Virus.DOS.Pro-Alife is a dangerous memory resident parasitic virus on DOS.

There are 3 variants:

  • Virus.DOS.Pro-Alife.3421
  • Virus.DOS.Pro-Alife.3423
  • Virus.DOS.Pro-Alife.3423.b

BehaviorEdit

When the virus is loaded into memory, it hooks onto INT 21h to infect any EXE executable that is run by writing itself to the end the file.

When a program is terminated, it displays one of the messages:

Kill an evil satanic ANTI-VIRAL product for Jesus today!
Stop Disinfectants NOW!
Ain't aLife A Beautiful Choice?
And God Said, "Let There Be Life!", and there was.....
Save the Viruses!  They're People Too!!!!
PRO-aLIFE and PROUD!  STOP THE VIRUS KILLERS! HALT THE AV!
STORM THE COMPU-CLINICS!  DON'T LET THEM KILL THE VIRUSES!!!
Operation Rescue-II, Save the HELPLESS UNBORN Viruses!!!

Memory usageEdit

The following table shows the memory usage of the variants.

Variant Memory usage in bytes
Pro-Alife.3421 4,096
Pro-Alife.3423 (A and B) 4,096

PayloadEdit

When any of the antivirus programs is executed:

F-PROT.EXE TBSCAN.EXE TBAV.EXE TBCLEAN.EXE SCAN.EXE CLEAN.EXE VIRSTOP.EXE MSAV.EXE VSAFE.EXE CPAV.EXE FSP.EXE VDEFEND.EXE

The virus overwrites them with the trojan program that displays being executed:

Eddie Lives, Somewhere in time!  ____________      1704     Jerusalem
Casino  :( ;( =(  Smeg off!      _____ ____  \   Frodo Lives!  APRIL FOOLS!
Get a late pass!    Datacrime    _______________        Brain   Void-Poem
Your PC is now STONED!           __ OO _____ O _  Copy me, I want to travel!
1,000,000,000 Viruses DIED Today!
And yesterday, and more will die tomorrow!
_/\_STOP THE KILLING!_/\_
Look What You're Doing To Them!
Below is an aborted virus... Support PRO-aLIFE Activism!
This program has been TERMINATED by the Virus Survival Underground Movement.
It had long stood as a horrible BABY VIRUS KILLER, and had to be removed.
Life, What a Beautiful Choice (tm).
--==___[OPERATION RESCUE II - SAVING THE BABY VIRUSES!]___==--
Thank you for choosing life over destruction.
Have a Nice Day (tm).

The size of this trojan program is 2,169 bytes, but it does not contain the viral code.

Other detailsEdit

There is a cracked version of Pro-Alife.3423, which is called JTTP, released on March 15 in 1996. It removes all the message from the original one and replaced the trojan code.

JTTP payload

The trojan program of JTTP

VideosEdit

Virus.DOS02:11

Virus.DOS.Pro-Alife

Pro-Alife virus review by Alles Sandro

Pro-Alife DOS Virus05:12

Pro-Alife DOS Virus

Pro-Alife virus review by danooct1

Ad blocker interference detected!


Wikia is a free-to-use site that makes money from advertising. We have a modified experience for viewers using ad blockers

Wikia is not accessible if you’ve made further modifications. Remove the custom ad blocker rule(s) and the page will load as expected.