FANDOM


Virus.DOS.Remember is a dangerous parasitic virus on DOS.

There are 9 variants in 2 versions, represented by the following:

  • Virus.DOS.Remember.811
  • Virus.DOS.Remember.1081

PayloadEdit

When the virus is run, it infects every DOS executable in current directory.

For Remember.1081 and variants having larger infection sizes, they also infect C:\COMMAND.COM and corrupt CMOS memory, causing some CMOS settings to lost and the system will fail to recognize the command interpreter after rebooting.

Some infected files may hang the system when run.

PayloadEdit

The virus activates on April 24th.

Remember.811, 816 and 818Edit

These variants contain the code of payload and the same activation day but failed to trigger.

Remember payload1

The first payload of Remember.

Remember.1081, 1087, 1091, 1277, 1283 and 1287Edit

When it is first loaded into memory, it displays the message with a telephone number:

 <<< Welcome >>>
=================================
 The OVEL bbs Tel is 02-927-7432
=================================

It also outputs 3 beeps before returning to DOS.

After that when an infected program is run, the virus types the binary content of the file before executing of the host program.

For some programs, the virus display a message box with some unreadable characters and a beep instead. The following text strings are noticeable:

Remember 4.0
Written by Jean at O.V.E.L

This message box appears differently in some variants.

VariantsEdit

This family has 9 variants in total:

  • Virus.DOS.Remember.811
  • Virus.DOS.Remember.816
  • Virus.DOS.Remember.818
  • Virus.DOS.Remember.1081
  • Virus.DOS.Remember.1087
  • Virus.DOS.Remember.1091
  • Virus.DOS.Remember.1277
  • Virus.DOS.Remember.1283
  • Virus.DOS.Remember.1287

Other DetailsEdit

The virus contains the internal text string:

*.com

Ad blocker interference detected!


Wikia is a free-to-use site that makes money from advertising. We have a modified experience for viewers using ad blockers

Wikia is not accessible if you’ve made further modifications. Remove the custom ad blocker rule(s) and the page will load as expected.