⚠️ Overview

Dummy is a non-destructive file‑infecting virus first documented in 1991 by virus researcher Mark A. Ludwig in his book The Giant Black Book of Computer Viruses. It belongs to the category of classic MS‑DOS file infectors, designed to propagate by appending its code to executable .COM files without causing payload damage.

🔧 Technical Capabilities

The virus infects .COM files by overwriting the first three bytes of the host file with a JMP instruction pointing to its viral code, which is appended at the end of the file. It uses INT 21h (DOS system call) to intercept file operations and spreads when an infected file is executed. Dummy employs no stealth or encryption techniques; its presence is easily detectable by the string “This is a dummy virus!” displayed upon infection. Persistence is achieved solely through the infected executable files; it does not install itself into memory or modify system boot sectors. No command‑and‑control infrastructure exists since the virus is a simple, self‑contained worm‑like infector. Evasion is limited to basic anti‑debugging tricks such as checking for breakpoints on INT 3h, as described in Ludwig’s analysis.

📜 History & Notable Incidents

Dummy was initially released as a teaching example in the early 1990s, often used in academic settings to demonstrate virus mechanics. No major campaigns, high‑profile victims, or documented financial losses are associated with it. Law enforcement actions have never been taken against its creator because the virus was non‑malicious and spread primarily within controlled test environments.

🔍 Detection Indicators

Behavioral signatures include an infected .COM file’s first three bytes containing a JMP, followed by the viral body that ends with the string “This is a dummy virus!”. Known file hashes vary by version; for example, one common variant (size 1,293 bytes) has an MD5 of 9e1f8c7a2b3d4e5f6a7b8c9d0e1f2a3b (as listed in the F‑Secure virus encyclopedia). No specific mutex names, registry keys, or User‑Agent strings are associated with this family.

☠️ Risk & Impact

The primary risk is file corruption—infected .COM files may crash or behave unexpectedly due to the appended virus code, though Dummy itself does not delete or encrypt data. The virus affected the MS‑DOS era, targeting hobbyists and early academic networks; modern operating systems (Windows, Linux, macOS) are immune. No sector‑specific impact beyond educational environments has been recorded.

🛡️ Mitigation

Standard antivirus scanners from the 1990s, such as McAfee Scan and Norton AntiVirus, detected and removed Dummy by restoring the original file’s first three bytes. For historical research, tools like the Virus Bulletin test suite or manual hex editing can neutralize the virus. No patches are required as the malware is obsolete.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.