The Alabama Virus is a computer virus which infects .EXE files. The virus is loaded into memory by executing an infected program and then affects the computer's runtime operation, corrupts program or overlay files. One hour after activation, the virus displays this message in a flashing box: SOFTWARE COPIES PROHIBITED BY INTERNATIONAL LAW Box 1055 Tuscambia ALABAMA USA. The virus manipulates the file allocation table and swaps file names so that files are slowly lost. The virus will infect .EXE files, increasing their size by 1,560 bytes. It moves into memory when any EXE containing the virus is executed. Unlike most other memory-resident viruses, the Alabama does not use the normal TSRfunction, but rather hooks interrupt 9 as well as IN and OUT commands. Upon detecting a Control-Alt-Delete, the virus generates what appears to be a warm boot, but remains in memory. The virus loads to the top 30K of memory, unlike other memory-resident programs, and does not reduce the available memory reported by DOS. The Alabama virus uses
a complex procedure during infection. It will first infect an EXE in the current directory, providing there is one which is uninfected. If all EXEs in the current directory are infected, then the Alabama virus will infect the program being executed - provided the system date is not Friday. On Fridays, the Alabama virus will swap entries in the FAT so that when the user attempts to execute an uninfected file, an infected file executes instead. Over time, files will be lost through this process. Research Alabama Virus
The Probert Encyclopaedia was designed, edited and programed by
Matt and Leela Probert
Abbreviations
Research Alabama Virus
