Hambone Virus

 Virus Name:  Hambone 
 V Status:    Rare 
 Discovered:  February, 1994 
 Symptoms:    .COM & .EXE growth; displays characters from memory 
 Origin:      Unknown 
 Eff Length:  2,316 Bytes 
 Type Code:   PNAK - Non-Resident Parasitic .COM &.EXE Infector 
 Detection Method:  AVTK, Sweep, ViruScan, F-Prot, IBMAV, NAV, NAVDX, 
                    AVTK/N, NShld, Sweep/N, IBMAV/N, NAV/N, NProt 
 Removal Instructions:  Delete infected files 
 General Comments: 
       The Hambone virus was received in February, 1994.  Its origin or 
       point of isolation is unknown, though it is probably from the 
       United States.  Hambone is a non-resident, direct action infector 
       of .COM and .EXE programs, including COMMAND.COM. 
       When a program infected with the Hambone virus is executed, this 
       virus will check to determine if there are any uninfected .EXE files 
       in the current directory.  If there are, the virus will infect them. 
       If the virus determines that all of the .EXE files were previously 
       infected, it will then infect any uninfected .COM programs it finds 
       in the current directory. 
       Programs infected with the Hambone virus will have a file length 
       increase of 2,316 bytes with the virus being located at the end of 
       the file.  The program's date and time in the DOS disk directory 
       listing will not be altered.  The following text strings are encrypted 
       within the viral code in all Hambone infected programs: 
               "(C) Martin Luther King Jr. 1994Fuhrer" 
               "Hambone, Hambone, have you heard?" 
               "Lawd have mussy" 
               "Hambone, Hambone, have you heard?" 
               "Oh Dem's Golden Slippers" 
               "Hambone, Hambone, have you heard?" 
               "Hambone, Hambone, have you heard?" 
               "I don't know nuttin' bout birthin' no babies,Miss Scarlett" 
               "Hambone, Hambone, have you heard?" 
               "Feets do yo' thang" 
               "Hambone, Hambone, have you heard?" 
               "I gots dem ol' Kozmic Blues again, Mama" 
               "Hambone, Hambone, have you heard?" 
               "Mammies lil' baby loves shortin'bread." 
               "Hambone, Hambone, have you heard?" 
               "Nobody know de troubles I seen" 
               "Hambone, Hambone, have you heard?" 
               "I gots a bad case o' de miseries today" 
               "Hambone, Hambone, have you heard?" 
               "In de sweet bye-de-bye" 
               "Hambone, Hambone, have you heard?" 
               "I lo-o-o-o-o-o-oves watermelon!" 
               "Hambone, Hambone, have you heard?" 
               "Great day in de mownin'" 
               "*.com *.exe .." 
       Programs infected with the Hambone virus will sometimes display 
       characters from memory on the system monitor when they are executed. 

Show viruses from discovered during that infect .

Main Page