Virus.DOS.BackTime is a dangerous memory resident parasitic virus on DOS.

There are 5 variants in 4 versions, represented by the following:

  • Virus.DOS.BackTime.496
  • Virus.DOS.BackTime.512
  • Virus.DOS.BackTime.527
  • Virus.DOS.BackTime.1234


When the virus is loaded into memory, it hooks INT 8 and 21h to infect any DOS executable file that is run.

BackTime.496 might not restore the registers when INT 8 is called.

Debugging is required for BackTime.527 for its runtime, otherwise it would print an "S" and then exit without staying memory resident. BackTime.528 is the bug fixing release.

BackTime.1234 also drops the virus Stoned.Michelangelo to the boot sector when it is run, and the dropped virus consumes 2K of memory.

Advanced details

The following table shows the memory usage of the variants.

Variant Memory usage in bytes
BackTime.496 512
BackTime.512 528
BackTime.527 ?
BackTime.528 544
BackTIme.1234 1,792

MD5 hashes:

Variant Hash
BackTime.496 de8434ade059bd5a254910a4a560aaaa
BackTime.512 06dad4277bc63a28cb2f0672503f70f4
BackTime.527 c244374e155a15eafcd848255fa0fc62
BackTime.528 0a438b5000da7bf075bd4767a6e38acf
BackTime.1234 76a7a42d947ea9239e4cb7078d096ca1



This variant does not manifest itself.


This variant manifests itself on CGA-adapter only, it "shakes" the screen.

BackTime.527 and 528

This virus sets the system timer in back direction, when the INT 8 is called the virus decrements the content of timer counter. At a result the programs that uses the timer characteristics of computer (like a BenchMarks) would hang-up.

However the virus does not change the time in CMOS memory, when the computer is rebooted, the time would restore, if the virus is not loaded again immediately.


This variant does not manifest itself, while the dropped virus does on March 6th.


This family has 5 variants in total:

  • Virus.DOS.BackTime.496
  • Virus.DOS.BackTime.512
  • Virus.DOS.BackTime.527
  • Virus.DOS.BackTime.528
  • Virus.DOS.BackTime.1234

Other details

BackTime.496 contains the internal text string:


BackTime.512 contains the internal text string:


BackTime.527 and 528 contain the internal text string:





BackTime virus review by Alles Sandro

BackTime DOS Virus

BackTime DOS Virus

BackTime virus review by danooct1