FANDOM


Hambone is a non-resident, direct action infector of .COM and .EXE programs, including COMMAND.COM

Payloads

When a program infected with the Hambone virus is executed, this virus will check to determine if there are any uninfected .EXE files in the current directory. If there are, the virus will infect them. If the virus determines that all of the .EXE files were previously infected, it will then infect any uninfected .COM programs it finds in the current directory. 

Programs infected with the Hambone virus will have a file length increase of 2,316 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory listing will not be altered. The following text strings are encrypted within the viral code in all Hambone infected programs: 

"(C) Martin Luther King Jr. 1994Fuhrer" 
"Hambone, Hambone, have you heard?" 
"Lawd have mussy" 
"Hambone, Hambone, have you heard?" 
"Oh Dem's Golden Slippers" 
"Hambone, Hambone, have you heard?" 
"Mammy!" 
"Hambone, Hambone, have you heard?" 
"I don't know nuttin' bout birthin' no babies,Miss Scarlett" 
"Hambone, Hambone, have you heard?" 
"Feets do yo' thang" 
"Hambone, Hambone, have you heard?" 
"I gots dem ol' Kozmic Blues again, Mama" 
"Hambone, Hambone, have you heard?" 
"Mammies lil' baby loves shortin'bread." 
"Hambone, Hambone, have you heard?" 
"Nobody know de troubles I seen" 
"Hambone, Hambone, have you heard?" 
"I gots a bad case o' de miseries today" 
"Hambone, Hambone, have you heard?" 
"In de sweet bye-de-bye" 
"Hambone, Hambone, have you heard?" 
"I lo-o-o-o-o-o-oves watermelon!" 
"Hambone, Hambone, have you heard?" 
"Great day in de mownin'" 
"*.com *.exe .."

Programs infected with the Hambone virus will sometimes display characters from memory on the system monitor when they are executed. 

Removal

Delete the infected files.

Community content is available under CC-BY-SA unless otherwise noted.