Abraxas, also known as Abraxas5, discovered in April 1993, is an encrypted, overwriting, file infecting
computer virus
A computer virus is a type of computer program that, when executed, replicates itself by modifying other computer programs and inserting its own code. If this replication succeeds, the affected areas are then said to be "infected" with a compu ...
which infects
.COM
The domain name .com is a top-level domain (TLD) in the Domain Name System (DNS) of the Internet. Added at the beginning of 1985, its name is derived from the word ''commercial'', indicating its original intended purpose for domains registere ...
and .
EXE
Exe or EXE may refer to:
* .exe, a file extension
* exe., abbreviation for executive
Places
* River Exe, in England
* Exe Estuary, in England
* Exe Island, in Exeter, England
Transportation and vehicles
* Exe (locomotive), a British locomotive
...
files, although it does not infect . It does not become memory resident. Each time an infected file is executed, Abraxas infects the copy of located in the C:\DOS directory (creating the file if it does not exist), as well as one EXE file in the current directory. Due to a bug in the virus, only the first EXE file in any directory is infected.
Abraxas-infected files will become 1,171
bytes in length and contain Abraxas' viral code. The file's date and time in the
DOS disk directory listing will be set to the system date and time when infection occurred. The following text strings can be found within the viral code in all Abraxas infected programs:
"*.exe c:\dos\dosshell.com .. MS-DOS (c)1992"
"->>ABRAXAS-5<<--"
"...For he is not of this day"
"...Nor he of this mind"
Execution of infected programs will also result in the display of a graphic "ABRAXAS" on the system display, accompanied by an ascending scale being played on the system speaker.
Abraxas was created with the
PS-MPC virus creation tool, which can be used to create similar, easily detected viruses, which are usually encrypted as well.
More than 20 viruses have appeared which have clearly been produced with the PS-MPC:
*
203 (computer virus)
*
644 (computer virus)
* Abraxas (computer virus)
*
ARCV-n (computer virus) Remark:
ARCV group has also produced viruses with the
TPE TPE may refer to:
Places
* Taipei (ISO 3166 code: TW-TPE), the capital of Taiwan
* " Chinese Taipei" (IOC and FIFA code: TPE), the name used in some international organizations and competitions for Taiwan
Science and Technology
* TPE (cable system ...
and developed the ARCV strain.
*
Joshua (computer virus)
*
Kersplat (computer virus)
*
McWhale (computer virus)
*
Mimic (computer virus)
*
Small ARCV (computer virus)
*
Small EXE (computer virus)
*
Swan Song (computer virus)
The name "Abraxas" was also used for a virus in the video game
Tron: Evolution.
See also
*
Actifed
Actifed is a registered trademark for a combination antihistamine and nasal decongestant medication used for cold and allergy symptoms. Actifed was developed in 1958 by Burroughs Wellcome & Company (now part of GlaxoSmithKline), later Haleon.
200 ...
References
{{reflist
External links
Abraxas virus by McAfee
by University of Hamburg
F-Secure Virus Descriptions : PS-MPC by Mikko Hypponen, F-Secure
by DecimatoR
by LineZer0 Network Zine
DOS file viruses