FANDOM


Virus.DOS.4Seasons.1534 is a memory resident parasitic virus on DOS.

Behavior

When the virus is loaded into memory, it hooks INT 13h, 14h, 21h to infect any DOS executable file that is run by writing itself to the beginning of the file, excluding COMMAND.COM.

The virus detects and deletes the file:

CHKLIST.CPS

Advanced details

MD5 hash:

2d33048cd88c24efc60d62b441f448f7

Payload

Depending on the system time, the virus deletes the files having the extension of DAT, or disables printing. Depending on its internal counters the virus disables Create/Delete Directory and Set Time/Date DOS-functions, slows down PC, erases disk sectors.

Other details

The virus contains the text strings:

.dat
chklist.cps
COMMAND
* THE FOUR SEASONS VIRUS * (C) WET, PARIS 1991 *
I HAD MUCH FUN WRITING THIS VIRUS, I HOPE YOU HAVE FUN WITH IT TOO!!

The following text string is also included in encrypted form:

* MES AMITIES A PATRICIA M., JE T'EMBRASSE TRES FORT ET JE PENSE A TOI *