Virus.DOS.CD, also called Thursday the 12th, is a memory resident polymorphic encrypted virus on DOS.

There are 2 variants:

  • Virus.DOS.CD.2161
  • Virus.DOS.CD.2170


When the virus is loaded into memory, it hooks INT 21h and infects any executable that is run by writing itself to the end of the file.

The infection size varies in different files.

Memory usageEdit

The following table shows the memory usage of the variants.

Variant Memory usage in bytes
CD.2161 2,448
CD.2170 2,448


The virus activates on Thursday 12th (followed by Friday 13th).

On every 4th execution of an infected program on this day, the virus displays a message in red background:

VirCheck V1.2 (c) 1991
Be aware of those worms out there, violating
your machine on Friday 13th - it's tomorrow!

Special thanks to Ross M. Greenberg,
Patricia M. Hoffmann and John McAfee
Press any key to continue...

And then the host program would run as usual after a keypress.

Other detailsEdit

There is no relationship between the term Compact Disc (CD in short, a secondary storage medium) and the name of this virus.

This virus is also called Thursday The 12th. Concerning the message in the payload, the virus actually does nothing other than infecting files on Friday 13th.


CD is a command on DOS, having a meaning of "Change Directory", it can also be used to display the current position by typing it without parameters:


If an executable file is named as "CD", the user will need to issue the following command in order to let the program run:


Which ".\" represents the current directory, making it possible to run the file.


  1. Description of the CD virus on Online VSUM
  2. Index of the CD virus samples on VX Heaven

Ad blocker interference detected!

Wikia is a free-to-use site that makes money from advertising. We have a modified experience for viewers using ad blockers

Wikia is not accessible if you’ve made further modifications. Remove the custom ad blocker rule(s) and the page will load as expected.