Type File virus
Date Discovered 1991.05
Place of Origin Europe?
Source Language
Platform DOS
File Type(s) .com
Infection Length 1,001 bytes
Reported Costs

Badboy was a file virus appearing in 1991. It uses a rather rare infection technique of breaking its code into several blocks and placing them randomly at the beginning of the file, similar to a virus appearing almost a decade later, Smash. It also appears to have some connection to Madsatan.


When an infected program is executed, the virus will install itself just below the 640 kilobyte DOS boundry. If the computer is booted from an disk with an infected copy of COMMAND.COM, the virus will occupy 3,072 bytes of system memory. When executed from any other file, it will occupy 6,704 bytes of free memory.

While Badboy is resident, it infects every .com file executed. The virus prepends itself to the beginning of the file in several blocks that will be randomly placed. It will scroll through several screens then halt the system.

It contains text strings that are never displayed:

"The bad boy halt your system ..." 
"The Bad Boy virus, Copyright (C) 1991."


Badboy produced a number of relatively interesting variants. Though these are/will be listed under separate entries, some variants of Immortal riot and Madsatan are condisered by some researchers to be actually variants of Badboy.


This variant will not become memory resident if it was executed from any other file than COMMAND.COM. The system hang and scrolling still occur, but are less frequent. It contains different text strings, the first of chich is encrypted in replicated infections.

"Make me better!" 
"The Bad Boy virus, Version 2.0, Copyright (C) 1991."


This variant first appeared around 1993 November. This variant avoids COMMAND.COM. Infected files will gain an extra 1,073 or 1,074 bytes. It does not alter the program's date and time in the DOS disk directory listing. It has the text string:

"The Worthless Piece of shit vi-rus that is a joke"


Patricia Hoffman. VSUM, Bad Boy Virus.

Kaspersky Lab. SecureList Virus.Win9x.Smash.10262.

Unless otherwise stated, the content of this page is licensed under Creative Commons Attribution-NonCommercial-ShareAlike 3.0 License