Fandom

Malware Wiki

Immortal

1,336pages on
this wiki
Add New Page
Comments0 Share

Virus.DOS.Immortal is a benign memory resident parasitic virus on DOS.

There are 6 variants:

  • Virus.DOS.Immortal.1894
  • Virus.DOS.Immortal.2174 (A, C, D and F)
  • Virus.DOS.Immortal.2185

Behavior

When the virus is loaded into memory, it traces and hooks INT 21h, and then it writes itself to the end of the files that are accessed.

When an infected program is run, the virus hides itself from some files which have been infected in the same section to make them appear to be disinfected, while the others that are also infected but not executed remain unchanged, as long as it stays in memory.

The timestamp of an infected file may also be modified by rolling back 28 years if the year of the original one is 2000 or afterwards.

Memory usage

The following table shows the memory usage of the variants.

Variant Memory usage in bytes
Immortal.1894 2,080
Immortal.2174 (A and C) 80^
Immortal.2174 (D and F) 2,384
Immortal.2185 80^

^Execution failed but still captured

Payload

Immortal1894

Immortal.1894 in action

The virus activates on December 22nd.

After system starts up, when the first infected program is run, the virus activates with a visual effect, and display the following message in large white letters at the top of the screen with font that resembles that of IBM:

I'M IMMORTAL!

Immortal.1894 displays the letters in white while that in Immortal.2174.d and f are in red.

Other details

There is a family of variants with the same name that belongs to the Riot family, having 21 variants and their infection sizes in a range of 264 to 589 bytes, but there is no relationship between this family and that in Riot.

There are programming faults which would access to other disk sectors during execution in variants 2174.a, c and 2185, any host program infected by any of these variants will never execute anymore due to the segmentation fault, debugging is required.

Immortal.1894, 2174 (A, D and F) and 2185 the internal text string:

IMMORTAL (c) 1994 by MW

Immortal.2174.c contains the internal text string:

IMMORTAL (c) 1995 by RH

Videos

Virus.DOS01:03

Virus.DOS.Immortal

Virus.DOS.Immortal by Alles

Immortal DOS Virus (High Quality)00:20

Immortal DOS Virus (High Quality)

Immortal on Virtual PC

Immortal DOS Virus00:22

Immortal DOS Virus

Immortal virus on Standalone PC

Ad blocker interference detected!


Wikia is a free-to-use site that makes money from advertising. We have a modified experience for viewers using ad blockers

Wikia is not accessible if you’ve made further modifications. Remove the custom ad blocker rule(s) and the page will load as expected.