Virus.DOS.ABC.2378 is a memory resident parasitic encrypted virus on DOS. It was discovered in October 1992.


When the virus is loaded into memory, it installs itself at the top of system memory but below the 640K DOS boundary. After that it hooks INT 21h to infect any EXE executable that is run, it also hooks INT 16h and 1Ch in addition.

It also alter the contents of DOS executable files, having a size change from 4 to 30 bytes, but no infection will be taken. However the timestamp of the files would be changed to the time of infection in both cases.

The virus might corrupt files during infection and hang the system when they are run, it would also alter the the COMSPEC environment variable.

Memory usage

The exact memory usage is 8,960 bytes.


The virus activates on the 13th day of every month, it randomly repeats the keystrokes to be entered.

Other details

The virus contains the encrypted internal text strings:

Ну теперь ты добрался и досюда. Я думаю,тебе интересно было посмотреть как написан вирус. Но что ты будеш делать
дальше? Если хочеш познакомится со мной то дай объявление в "АиФ", "7 дней" или в какой-нибудь компьютерный журнал/
газету для автора вируса "ABC_FFEA". А теперь пока. Minsk 8.01.92 ABC