Virus.DOS.DirVirus is a memory resident parasitic virus on DOS.

There are 2 variants:

  • Virus.DOS.DirVirus.691
  • Virus.DOS.DirVirus.760


When the virus is loaded into memory, it first infects C:\COMMAND.COM so that it would be loaded automatically on upcoming boots, followed by hooking INT 21h to infect any DOS executable that is run.

The virus behaves stealthy so that there will have no observable size change on infected files, but allocation errors might appear, and it would damage these files if the user attempts to fix them via CHKDSK.

The user might encounter a slower response on issuing DIR commands.

However, the virus does not manifest itself at anyway.

Advanced details

The following table shows the memory usage of the variants.

Variant Memory usage in bytes
DirVirus.691 1,072
DirVirus.760 1,136

MD5 hash:

Variant Hash
DirVirus.691 5ca3d65ad8757d46c04e81cfa924cb8a
DirVirus.760 a2198ecd94569a37760485ea11b2455e

Other details

This virus has another alias of "DIR", which is also a command in DOS, Windows and Linux. It is used to list files in a certain directory that the user may customize the listing by adding different switches.