%%File: VIRS0294.TXT
%%Name/Aliases: Devil's Dance, Mexican, 941, 951
%%Platform: PC/MS-DOS
%%Type: Program., 
%%Disk Location: COM application.
%%Features: Memory resident; TSR.
%%Damage: Interferes with a running application., Corrupts a program or 
overlay files., Corrupts a data file., Corrupts the file linkages or the 
FAT., Overwrites sectors on the Hard Disk.
%%Size: 941, 951?
%%See Also: 
%%Notes: Infects all .COM files in the current directory multiple times.   
Pressing Ctrl-Alt-Del  displays
                                                                           
        DID YOU EVER DANCE WITH THE DEVIL IN THE WEAK MOONLIGHT ?          
                         PRAY FOR YOUR DISKS!!                             
                               The Joker                                   
                                    
The virus counts keystrokes. After 2000 it activates, and and changes 
the screen colors, after 5000 it destroys the FAT                                       
  The file date/time is set to the date/time of the infection (i.e. 
multiple infected files  have the same file date/time). 
 All characters typed will be displayed in a different color on a color 
card.
If <CTRL>+<ALT>+<DEL> is pressed, the following message is displayed: 
 "Have you ever danced with", "the devil under the weak light of the 
moon? ", "Pray for your disk! The_Joker...", "Ha Ha Ha Ha Ha Ha Ha Ha Ha 
Ha".   Typical text in Virus body, readable with hexdump-utilities: 
"Drk", "*.com". If the high- bit of the displayed code is stripped, the 
message displayed at system reset time can be read.  .COM files: the 
first three bytes (jmp) and  the last three bytes are identical. The 
file date/time is set to the date/time of  the infection (i.e. multiple 
infected files have the same file date/time).  
v6-151: At least one anti-virus program can detect and remove Devil's 
Dance (C and D).