Virus.DOS.04h is a memory resident parasitic virus on DOS.

There are 2 variants:

  • Virus.DOS.04h.609
  • VIrus.DOS.04h.635


When the virus is loaded into memory, it hooks INT 21h to infect any DOS executable that is run or accessed by FindFirst (AH=4Eh) by writing itself to the beginning of the file.

The virus is unable to infect files smaller than 1,024 bytes, in such case when these files are run, the virus simply ignores them. If a file listing command is issued, the virus might crash the system on attempting to infect these files.

Memory usage

The following table shows the memory usage of the variants.

Variant Memory usage in bytes
04h.609 1,648
04h.635 1,664

Other details

The virus encrypts only the internal text strings, not its code.

04h.609 contains the encrypted internal text string:

04h Virus, (c) Enrico*.com

04h.635 contains the encrypted internal text string:

04h Virus*.com