It has 4 variants:
- Virus.DOS.Hymn.1865 (A and B)
When the virus is loaded, it hooks INT 21h, and writes itself to the end of the executables that are run, closed, renamed or when the file attributes are changed.
Depending on the system date, that the value of the month is equal to that of the day, this virus destroys a part of the system information in the C: disk boot sector, then it plays the first verse of the former USSR national anthem, and decrypts and displays the picture.
When corrupting the boot sector, the virus sets the bytes to zero in the boot sector that contains the number of bytes in a sector, number of sectors in a cluster, number of FAT copies, etc. a total of 9 bytes. If the boot sector of a computer running in the MS-DOS environment is changed in such a way, the computer remains unbootable both from the hard disk and the floppy drive. To restore information, it is necessary to use special utilities.
Hymn.1865 contains the internal text strings: