Fandom

Malware Wiki

Tumen

1,328pages on
this wiki
Add New Page
Comments0 Share

Virus.DOS.Tumen is a memory-resident parasitic virus on DOS, this virus activates by tracking keyboard's activity.

There are 4 variants:

  • Virus.DOS.Tumen.1092
  • Virus.DOS.Tumen.1242
  • Virus.DOS.Tumen.1255
  • Virus.DOS.Tumen.1663

BehaviorEdit

When the virus is loaded into memory, it hooks INT 9 and 21h to infect any DOS executable that is run. The timestamp of the file will be changed to the time of infection. INT 9 is used to track for specified input key combination from the keyboard.

Files infected by the virus might not function properly or even to hang the system when they are run.

Memory usageEdit

The following table shows the memory usage of the variants.

Variant Memory usage in bytes
Tumen.1092 4,096
Tumen.1242 4,096
Tumen.1255 4,096
Tumen.1663 4,096

PayloadEdit

Tumen.1092Edit

When the user attempts to load a graphical program, it hangs the system after a keystroke.

Tumen.1242 and 1255Edit

These variants contain the code of payload of Tumen.1663 but the method of activation is currently unknown.

Tumen.1663Edit

When the virus is in memory and the user inputs CTRL-ALT and any key except some of the control keys, the virus activates by playing a tune from the PC speaker and eventually turns the screen to black, hangs the system and disables the keyboard input (but still detects some control keys).

Other detailsEdit

The following conditions may make the payload of the virus to run insanely by playing the tune in super speed:

  • Input CTRL-ALT with Insert, Delete, Home, End, PageUp or PageDown
  • Input CTRL-ALT with or without any key during the payload
  • Holding CTRL-ALT with or without any key

The melody of the payload is known as a part of Caprice No.24 in A minor by Niccolò Paganini in 1817.

This virus could be detected and infected by another virus called SSR, as long as SSR stays in memory.

Tumen.1092 contains the internal text strings:

Be careful... Hacker time tonight...
This present was created in Tumen at 1990.
v 2.0.(c) Max Soft corporation

Tumen.1242 contains the internal text string:

Tumen.,v1.3;

Tumen.1255 contains the internal text string:

Tumen.,v1.2;

Tumen.1663 contains the internal text strings:

Full moon tonight...
The time of Wolfbacks...
U...U...U...
This is only demonstration version, but you hear some howl.

(C) Copyright MMA Company
All rights reserved. USSR Tumen 1990-v0.5
This program was created in Tumen by group of three Wolfbacks at April,1990
General System_&_Files affecting effects by Max
Main consultant -- Tall Lazy Micle
General Music_&_Video harmless effects by Alex
BACKWOLFS OF THE WORLD, UNITE ! ! !

VideosEdit

Virus.DOS03:34

Virus.DOS.Tumen

Tumen virus review by danooct1

Ad blocker interference detected!


Wikia is a free-to-use site that makes money from advertising. We have a modified experience for viewers using ad blockers

Wikia is not accessible if you’ve made further modifications. Remove the custom ad blocker rule(s) and the page will load as expected.