|Place of Origin||Taiwan|
|File Type(s)||.com, .exe|
When a file infected with Madsatan is executed, it becomes memory resident. It infects .com and .exe files as they are executed, appending itself to the end of the file.
Some variants of Madsatan are considered variants of Jerusalem depending on the antivirus product. One variant is sometimes considered a variant of Tamsui. The basics of all Jerusalem and Madsatan variants are the same (ability to infect .com and .exe files, memory residency). In fact, very few antivirus products acknowledge a large Madsatan family, one rare exception being Kaspersky. Others label the variants as individual viruses seperate from any family or as members of other families. However, they all have in common that they are signed by Mad Satan, a virus coder from Taiwan.
Different versions have different text strings in them. Some may also choose to only infect one type of file while memory resident.
Kaspersky Lab. SecureList, Virus.DOS.MadSatan.599. 2000.03.07