Fandom

Malware Wiki

Semtex

1,326pages on
this wiki
Add New Page
Comments0 Share

Virus.DOS.Semtex is a memory resident parasitic virus on DOS.

There are 5 variants in 3 versions, represented by the following:

  • Virus.DOS.Semtex.515
  • Virus.DOS.Semtex.619
  • Virus.DOS.Semtex.686

BehaviorEdit

When the virus is loaded into memory, it infects C:\COMMAND.COM by instant, followed by hooking INT 8 and 21h to infect any DOS executable that is run. Except Semtex.515 and 686, they do not infect any files, but would decrease the total available system memory by 4K.

For Semtex.686, a system hang would occur when the user runs it while the virus is already in memory.

Memory usageEdit

The following table shows the memory usage of the variants.

Variant Memory usage in bytes
Semtex.515 4,080
Semtex.619 4,080
Semtex.686 4,096
Semtex.1000.a 4,096
Semtex.1000.b 4,080

PayloadEdit

Showing colorful boxes and random characters is the payload of this virus, which is similar to Crash but the characters to be shown by this virus are trended to be more random.

This virus does not hang the system during the payload so the user may still run any tasks, even the random characters are blocking the user's view.

Semtex.515Edit

This variant activates immediately. Upon a keypress, it changes the characters on screen.

Semtex.619 and 1000.aEdit

These variants do not activate immediately, but activate on every time when there is no keyboard activity for about 1 minute.

Semtex.686 and 1000.bEdit

Every time the minute of the system time hits 0, these variants activate once.

VariantsEdit

This family has 5 variants in total:

  • Virus.DOS.Semtex.515
  • Virus.DOS.Semtex.619
  • Virus.DOS.Semtex.686
  • Virus.DOS.Semtex.1000 (A and B)

Other detailsEdit

Semtex.619 has been identified as Semtex.1000.b by some antiviruses even the infection sizes are actually different.

Semtex.515 contains the internal text string:

S E M T E X  by Dusan Toman, CZECHOSLOVAKIA (7)213-040 or (804)212-23

Semtex.619 contains the internal text strings:

S E M T E X  by Dusan Toman, CZECHOSLOVAKIA (7)213-040 or (804)212-23
Hell

Semtex.686 contains the internal text string:

!!!  explosive  !!!       S  E  M  T  E  X       !!!  explosive  !!!
Written by Dusan Toman, CZECHOSLOVAKIA Pyrotechnician Lilo Hedera
(7)213-040 or (804)212-23

Semtex.1000.a contains the internal text strings:

S E M T E X  by Dusan Toman, CZECHOSLOVAKIA (7)213-040 or (804)212-23
Hell
no label
v0412

Semtex.1000.b contains the internal text strings:

S E M T E X  by Dusan Toman, CZECHOSLOVAKIA
***  Have a nice day  ***

Ad blocker interference detected!


Wikia is a free-to-use site that makes money from advertising. We have a modified experience for viewers using ad blockers

Wikia is not accessible if you’ve made further modifications. Remove the custom ad blocker rule(s) and the page will load as expected.