Created: 2007-11-27, 19:19:16
Last updated on: 2008-03-12, 14:22:43

Platform: MS-DOS Type: virus Size: 793
Date: 1990-06

Endangered operating system(s): DOS


The different antivirus applications use different names for the individual viruses and worms. Sometimes an antivirus application identifies the same individual malware using different names for different copies or different viruses and worms are identified with the same name. The informative list below contains the names for the malware given by the most popular antivirus applications. The names can vary using the different versions of the same antivirus application.

antivirus naming
Avast Ambulance-795
AVG Ambulance.796.D
BitDefender PS-MPC.0796.AP.Gen
e-Trust Ambulance
F-PROT Ambulance.796.D
F-Secure Virus.DOS.Ambulance.796.a
Ikarus Virus.DOS.Ambulance.793
Kaspersky Virus.DOS.Ambulance.796.a
McAfee Ambulance(Virus)
Microsoft DOS/Ambulance_796.D
NOD32 (ESET) Amblance.D
Norton Antivirus Ambulance.A
Panda Ambulance.796.A
Rising Antivirus Redx
Sophos Ambulance
Trend Micro AMBULANCE.796A
VirusBuster Ambulance.796.C


The main aim of the viruses is to infect other program areas. These areas can be program files, sectors containing program codes (boot sector, MBR – master boot record). Certain viruses infect in several ways in the particular areas. The virus code may contain a separate algorithm to infect special files (e.g., COMMAND.COM).

Infection of COM files

Payload functions

Every virus and worm can do what it or its programmer wants. Some malware executes its payload function depending on a particular event, sometimes these functions are executed on specific dates and time.

MS-DOS/Amblance.D virus executes the following payload function:

condition randomly
activity a 5-line high ambulance car passes the screen from left to right, sounding the siren through the speaker.

You don't have Adobe Flash Player installed on your computer! Please download it here!

Ways of infection

Part of the viruses and program worms saves special entries in their code to remember which directories of the hard disc are to be searched for files to be infected or in which directories they can install program files carrying the executable code of the damaging program in the hope of a secure and permanent control.

MS-DOS/Amblance.D virus infects the files of the current directory.

MS-DOS/Amblance.D virus infects the program files available at path.


Most viruses get into the memory as residents, however, there are directly infecting viruses (as parasites) that after running their program code return the control to the host program and quit the memory.

MS-DOS/Amblance.D virus does not produce a memory resident behaviour, and after running itself as a parasite, directly infecting, returns the control to the host program and the operation system.