Virus.DOS.CD also called as Thursday the 12th, is a memory resident polymorphic encrypted virus on DOS.

There are 2 variants:

  • Virus.DOS.CD.2161
  • Virus.DOS.CD.2170


When the virus is loaded into memory, it hooks INT 21h and infects any executable that is run by writing itself to the end of the file.

The infection size varies in different files.

Memory usage

The following table shows the memory usage of the variants.

Variant Memory usage in bytes
CD.2161 2,448
CD.2170 2,448

MD5 hashes:

Variant Hash
CD.2161 23ffc720a11494d3074529b61d9f0220
CD.2170 17043ecb82fda340660df4d2ad99cc68


The virus activates on Thursday 12th (followed by Friday 13th).

On every 4th execution of an infected program on this day, the virus displays a message in red background:

VirCheck V1.2 (c) 1991
Be aware of those worms out there, violating
your machine on Friday 13th - it's tomorrow!

Special thanks to Ross M. Greenberg,
Patricia M. Hoffmann and John McAfee
Press any key to continue...

And then the host program would run as usual after a keypress.

Other details

There is no relationship between the term Compact Disc (CD in short, a secondary storage medium) and the alias of this virus.

This virus is also called Thursday The 12th. Concerning the message in the payload, the virus actually does nothing other than infecting files on Friday 13th.

About the alias

CD is a command on DOS, having a meaning of "Change Directory", it can also be used to display the current position by typing it without parameters:


If an executable file is named as "CD", the user will need to issue the following command in order to let the program run:


Which ".\" represents the current directory, making it possible to run the file.


  1. Description of the CD virus on Online VSUM
  2. List of variants of the CD virus on VX Heaven