Pro-Alife

This page was heavily influenced by The Malware Wiki's Page on Pro-Alife

Variants
Virus.DOS.Pro-Alife is a virus that runs on MS-DOS.

There are 3 variants:
 * Virus.DOS.Pro-Alife.3421
 * Virus.DOS.Pro-Alife.3423
 * Virus.DOS.Pro-Alife.3423.b

Behavior
Once the program is launched, it hooks itself onto INT 21h (the Keyboard Input with Echo handler) and then spreads by writing to the end of an EXE file.

Hash
When one of the infected files are terminated, the virus will print a random string: [0] Kill an evil satanic ANTI-VIRAL product for Jesus today! [1] Stop Disinfectants NOW! [2] Ain't aLife A Beautiful Choice? [3] And God Said, "Let There Be Life!", and there was..... [4] Save the Viruses! They're People Too!!!! [5] PRO-aLIFE and PROUD! STOP THE VIRUS KILLERS! HALT THE AV! [6] STORM THE COMPU-CLINICS! DON'T LET THEM KILL THE VIRUSES!!! [7] Operation Rescue-II, Save the HELPLESS UNBORN Viruses!!!

Payload
Instead of running the anti-virus program, it will run this instead.

The largest text reads "8440c021" and displays 2 phages. Eddie Lives, Somewhere in time! ____________     1704     Jerusalem Casino  :( ;( =( Smeg off!      _____ ____  \   Frodo Lives!  APRIL FOOLS! Get a late pass!    Datacrime    _______________        Brain   Void-Poem Your PC is now STONED!           __ OO _____ O _  Copy me, I want to travel! 1,000,000,000 Viruses DIED Today! And yesterday, and more will die tomorrow! _/\_STOP THE KILLING!_/\_ Look What You're Doing To Them! Below is an aborted virus... Support PRO-aLIFE Activism! This program has been TERMINATED by the Virus Survival Underground Movement. It had long stood as a horrible BABY VIRUS KILLER, and had to be removed. Life, What a Beautiful Choice (tm). --==___[OPERATION RESCUE II - SAVING THE BABY VIRUSES!]___==-- Thank you for choosing life over destruction. Have a Nice Day (tm).