Summary

Madman is a simple TSR, EXE infector. The virus body is encrypted with 16bit variable XOR key. The virus infects EXE files during the DOS close function.

Additional Details

The virus activates when ctrl-alt-del is used. First it displays a close-up ascii picture of a face and then it displays the following message and waits for a keypress:

Nothing can save you here, friend - you're in my world now!
The virus also modifies batch files by adding an ECHO line at their end:

@ECHO I'm watching you!
The virus also contains the text 'MadMan'.

[Analysis: Peter Szor, F-Secure, 1996]