Fandom

Malware Wiki

Truxested

1,346pages on
this wiki
Add New Page
Comments0 Share

Virus.DOS.Truxested is a dangerous memory resident parasitic virus on DOS.

There are 4 variants:

  • Virus.DOS.Truxested.1154
  • Virus.DOS.Truxested.1291
  • Virus.DOS.Truxested.1464
  • Virus.DOS.Truxested.1472

Behavior

When the virus is loaded into memory, it first infects these files:

C:\DOS\DOSKEY.COM
C:\DOS\EDIT.COM
C:\DOS\FORMAT.COM
C:\DOS\KEYB.COM
C:\DOS\SYS.COM
C:\DOS\UNFORMAT.COM
C:\WINDOWS\WIN.COM

After that it hooks INT 21h to infect any DOS executable that is run except COMMAND.COM. After infection, these files may no longer function properly, usually causing a system hang after execution.

The virus behaves stealthy so that no size change can be observed.

Memory usage

The following table shows the memory usage of the variants.

Variant Memory usage in bytes
Truxested.1154 1,184
Truxested.1291 1,312
Truxested.1464 1,744
Truxested.1472 1,488

Payload

When an infected program is run on the 1st of any month, the virus displays a demo effect of other DOS virus. The payload demos can be stopped and then return to DOS by pressing ESC key, while the host program would never execute anymore.

Truxested.1154

This variant displays the payload of the virus Flame, a variant in the family of the boot sector virus Stoned.

Trux1291 payload

Garbage characters displayed in the payload of Truxested.1291

Truxested.1291

This variant tries to display the payload of the virus SillyWilly, but due to some programming faults, it displays gibberish characters instead.

Truxested.1464

This variant displays the payload of the virus Devil's Dance.

Truxested.1472

This variant plays a tune of the virus Goodbye.

Other details

The virus contains the internal text string:

What??? Truxested??? Me???
c:\dos\doskey.com
c:\dos\edit.com
c:\dos\format.com
c:\dos\keyb.com
c:\dos\sys.com
c:\dos\unformat.com
c:\windows\win.com

Ad blocker interference detected!


Wikia is a free-to-use site that makes money from advertising. We have a modified experience for viewers using ad blockers

Wikia is not accessible if you’ve made further modifications. Remove the custom ad blocker rule(s) and the page will load as expected.