There are 4 variants:
When the virus is loaded into memory, it hooks INT 9 and 21h to infect any DOS executable that is run. The timestamp of the file will be changed to the time of infection. INT 9 is used to track for specified input key combination from the keyboard.
Files infected by the virus might not function properly or even to hang the system when they are run.
The following table shows the memory usage of the variants.
|Variant||Memory usage in bytes|
You can obtain information by checking the MD5 hash codes.
When the user attempts to load a graphical program, it hangs the system after a keystroke.
Tumen.1242 and 1255Edit
These variants contain the code of payload of Tumen.1663 but the method of activation is currently unknown.
When the virus is in memory and the user inputs CTRL-ALT and any key except some of the control keys, the virus activates by playing a tune from the PC speaker and eventually turns the screen to black, hangs the system and disables the keyboard input (but still detects some control keys).
The melody of the payload is known as a part of Caprice No.24 in A minor by Niccolò Paganini in 1817.
The following conditions may make the payload of the virus to run insanely by playing the tune in super speed:
- Input CTRL-ALT with Insert, Delete, Home, End, PageUp or PageDown
- Input CTRL-ALT with or without any key during the payload
- Holding CTRL-ALT with or without any key
This virus could be detected and infected by another virus called SSR, as long as SSR stays in memory.
Tumen.1092 contains the internal text strings:
Be careful... Hacker time tonight... This present was created in Tumen at 1990. v 2.0.(c) Max Soft corporation
Tumen.1242 contains the internal text string:
Tumen.1255 contains the internal text string:
Tumen.1663 contains the internal text strings:
Full moon tonight... The time of Wolfbacks... U...U...U... This is only demonstration version, but you hear some howl. (C) Copyright MMA Company All rights reserved. USSR Tumen 1990-v0.5 This program was created in Tumen by group of three Wolfbacks at April,1990 General System_&_Files affecting effects by Max Main consultant -- Tall Lazy Micle General Music_&_Video harmless effects by Alex BACKWOLFS OF THE WORLD, UNITE ! ! !
- List of variants of the Tumen virus on VX Heaven