Virus.DOS.Immortal is a benign memory resident parasitic virus on DOS.

There are 6 variants:

  • Virus.DOS.Immortal.1894
  • Virus.DOS.Immortal.2174 (A, C, D and F)
  • Virus.DOS.Immortal.2185


When the virus is loaded into memory, it traces and hooks INT 21h, and then it writes itself to the end of the files that are accessed.

When an infected program is run, the virus hides itself from some files which have been infected in the same section to make them appear to be disinfected, while the others that are also infected but not executed remain unchanged, as long as it stays in memory.

The timestamp of an infected file may also be modified by rolling back 28 years if the year of the original one is 2000 or afterwards.

Advanced details

The following table shows the memory usage of the variants.

Variant Memory usage in bytes
Immortal.1894 2,080
Immortal.2174 (A and C) 80^
Immortal.2174 (D and F) 2,384
Immortal.2185 80^

^Execution failed but still captured

MD5 hashes:

Variant Hash
Immortal.1894 d9c5f7c10b0721e8f210249aae4d4774
Immortal.2174.a 0319a0fa515d17144a97768fc6e3c152
Immortal.2174.c 1baaf2265381557ab98f37b746fbf320
Immortal.2174.d 4c5877fb4abfa2efbc971515cb2c4db9
Immortal.2174.f c48d883e86c6a38cb534e6000a2f8319
Immortal.2185 b718f7fdacc108444752a413d5c1dd6b



Immortal.1894 in action

The virus activates on December 22nd.

After system starts up, when the first infected program is run, the virus activates with a visual effect, and display the following message in large white letters at the top of the screen with font that resembles that of IBM:


Immortal.1894 displays the letters in white while that in Immortal.2174.d and f are in red.

Other details

There is a family of variants with the same name that belongs to the Riot family, having 21 variants and their infection sizes in a range of 264 to 589 bytes, but there is no relationship between this family and that in Riot.

There are programming faults which would access to other disk sectors during execution in variants 2174.a, c and 2185, any host program infected by any of these variants will never execute anymore due to the segmentation fault, debugging is required.

Immortal.1894, 2174 (A, D and F) and 2185 the internal text string:

IMMORTAL (c) 1994 by MW

Immortal.2174.c contains the internal text string:

IMMORTAL (c) 1995 by RH


  1. List of variants of the Immortal virus on VX Heaven




Virus.DOS.Immortal by Alles

Immortal DOS Virus (High Quality)

Immortal DOS Virus (High Quality)

Immortal on Virtual PC

Immortal DOS Virus

Immortal DOS Virus

Immortal virus on Standalone PC