Alabama | |
---|---|
Type | File virus |
Creator | |
Date Discovered | 1989.10 |
Place of Origin | Israel |
Source Language | |
Platform | DOS |
File Type(s) | .exe |
Infection Length | 1,560 Bytes |
Reported Costs |
Alabama is DOS .exe infector from 1988. While its name may suggest that it is from the southern United States, it actually comes from Israel. It has a few particularly unusual habits with regard to when it infects a file.
Behavior
When a file infected with Alabama is executed, the virus becomes memory resident. Unlike some other memory resident viruses, it does not necessarily infect a file when it is executed. It will try to find a file to infect in the current directory, and failing that, will infect the file that has been executed. Every Friday, instead of infecting a file that it finds, it will execute that file instead of the one the user intended.
One hour after execution, the virus displays the flashing text:
SOFTWARE COPIES PROHIBITED BY INTERNATIONAL LAW..............
Box 1055 Tuscambia ALABAMA USA.
Variants
The one known variant Alabama.B infects .com files.
Name
The virus gets its name from the text it displays on the screen, but it is not from there. Ironically, Alabama was actually discovered in Israel.
Other Facts
There is a joke about an "Alabama virus", which is really just a program that displays a message telling the user to delete all files on the computer and pass the program to other users. The joke is most likely not related to the actual Alabama virus. There are similar jokes targeting other regional and ethnic stereotypes.
The city of Tuscumbia, Alabama, where the virus claims to come from, is also the home of Helen Keller.
Sources
Yisrael Radai, Hebrew University of Jerusalem. Reports collected and collated by PC-Virus Index, Alabama. OWWCD
F-Secure Antivirus, F-Secure Virus Descriptions : Alabama.