Virus.DOS.Tumen is a memory-resident parasitic virus on DOS, this virus activates by tracking keyboard's activity.

There are 4 variants:

  • Virus.DOS.Tumen.1092
  • Virus.DOS.Tumen.1242
  • Virus.DOS.Tumen.1255
  • Virus.DOS.Tumen.1663


When the virus is loaded into memory, it hooks INT 9 and 21h to infect any DOS executable that is run. The timestamp of the file will be changed to the time of infection. INT 9 is used to track for specified input key combination from the keyboard.

Files infected by the virus might not function properly or even to hang the system when they are run.

Advanced details

The following table shows the memory usage of the variants.

Variant Memory usage in bytes
Tumen.1092 4,096
Tumen.1242 4,096
Tumen.1255 4,096
Tumen.1663 4,096

MD5 hashes:

Variant Hash
Tumen.1092 8816206f8e13c6564a138e047f5b02b1
Tumen.1242 3b6de7f1d75a2384a8399ebe23e8c3c2
Tumen.1255 531c2cdc0b6296997bc84e094553c8ae
Tumen.1663 0919a240e3930b171091a03c8ca75f42



When the user attempts to load a graphical program, it hangs the system after a keystroke.

Tumen.1242 and 1255

These variants contain the code of payload of Tumen.1663 but the method of activation is currently unknown.


When the virus is in memory and the user inputs CTRL-ALT and any key except some of the control keys, the virus activates by playing a tune repeatedly from the PC speaker and eventually turns the screen to black, hangs the system and disables the keyboard input (but still detects some control keys).

Other details

The melody of the payload is known as a part of Caprice No.24 in A minor by Niccolò Paganini in 1817.

The following conditions may make the payload of the virus to run insanely by playing the tune in super speed:

  • Input CTRL-ALT with Insert, Delete, Home, End, PageUp or PageDown
  • Input CTRL-ALT with or without any key during the payload
  • Holding CTRL-ALT with or without any key

This virus could be detected and infected by another virus called SSR, as long as SSR stays in memory.

Tumen.1092 contains the internal text strings:

Be careful... Hacker time tonight...
This present was created in Tumen at 1990.
v 2.0.(c) Max Soft corporation

Tumen.1242 contains the internal text string:


Tumen.1255 contains the internal text string:


Tumen.1663 contains the internal text strings:

Full moon tonight...
The time of Wolfbacks...
This is only demonstration version, but you hear some howl.

(C) Copyright MMA Company
All rights reserved. USSR Tumen 1990-v0.5
This program was created in Tumen by group of three Wolfbacks at April,1990
General System_&_Files affecting effects by Max
Main consultant -- Tall Lazy Micle
General Music_&_Video harmless effects by Alex


  1. List of variants of the Tumen virus on VX Heaven




Tumen virus review by danooct1

Community content is available under CC-BY-SA unless otherwise noted.