Virus.DOS.Hymn or Hymn is a memory resident parasitic encrypted virus that runs on MS-DOS.

It has 4 variants:

  • Virus.DOS.Hymn.1865 (A and B)
  • Virus.DOS.Hymn.1962
  • Virus.DOS.Hymn.2144


When the virus is loaded, it hooks INT 21h, and writes itself to the end of the executables that are run, closed, renamed or when the file attributes are changed.

Depending on the system date, that the value of the month is equal to that of the day, this virus destroys a part of the system information in the C: disk boot sector, then it plays the first verse of the former USSR national anthem, and decrypts and displays the picture.

When corrupting the boot sector, the virus sets the bytes to zero in the boot sector that contains the number of bytes in a sector, number of sectors in a cluster, number of FAT copies, etc. a total of 9 bytes. If the boot sector of a computer running in the MS-DOS environment is changed in such a way, the computer remains unbootable both from the hard disk and the floppy drive. To restore information, it is necessary to use special utilities.

HYMN Virus

Hymn run on Windows

Other details

Hymn.1865 contains the internal text strings:



Ad blocker interference detected!

Wikia is a free-to-use site that makes money from advertising. We have a modified experience for viewers using ad blockers

Wikia is not accessible if you’ve made further modifications. Remove the custom ad blocker rule(s) and the page will load as expected.