FANDOM


Virus.DOS.Raving.2300 is a companion file virus on DOS.

Payload

When the virus is run, it drops a file called HUNDRED.COM and activates immediately. If such file is already existed, the virus would overwrite it.

The virus does not infect any executable.

Advanced details

It is unknown whether the virus would stay memory resident, but would keep running once it is being executed and no system reset is being made.

MD5 hash:

1289ebffa03df833c265997cc0c10e21

Payload

The virus hooks INT 16h and disrupt the keyboard by substituting the characters to jibberish one, but not include some control inputs such as Shift, Ctrl, Alt and Del, making it impossible to execute any program (the Enter key is also interfered) but resetting the system. It displays the message after a number of keystrokes:

I DON'T THINK YOU WOULD LIKE TO SMILE, BECAUSE I HAVE INFECTED A FILE!!!
HAVE YOU HEARD OF A RAVING VIRUS MC, YES YOU GUESSED IT THAT IS ME!!!
YOU WONT SEE ANOTHER RHYME UNTIL IT IS INFECTING TIME!!!

Other Details

The virus contains the internal text strings:

*.com
command.com
HUNDRED.COM

Media

Virus.DOS

Virus.DOS.Raving

Raving virus review by danooct1