Virus Name: DOS3
V Status: Rare
Discovered: February, 1993
Symptoms: .COM & .EXE growth; message displayed on some systems
Eff Length: 661 Bytes
Type Code: PNA - Parasitic Non-Resident .COM & .EXE Infector
Detection Method: AVTK, F-Prot, ViruScan, Sweep, NAV, IBMAV,
NAVDX, VAlert, PCScan, ChAV,
NShld, NProt, AVTK/N, NAV/N, Sweep/N, IBMAV/N, Innoc,
Removal Instructions: Delete infected files
The DOS3 virus was submitted in February, 1993. Its origin or
point of isolation is unknown. The DOS3 virus is a non-resident,
direct action infector of .COM and .EXE programs, but not
When a program infected with the DOS3 virus is executed, the DOS3
virus will infect all of the .COM and .EXE programs located in
the current directory, with the exception of COMMAND.COM. Infected
programs will have a file length increase of 661 bytes with the
virus being located at the end of the file. The program's date and
time in the DOS disk directory listing will not be altered. The
following text strings are encrypted within the DOS3 virus' code
in all infected programs:
"Still using DOS 3?"
"You need to upgrade, you loser!"
"*.EXE *.COM .."
The first two text strings may be displayed as a message on the
system monitor when an infected program is executed on computer
which uses Ms-Dos 3.0 to Ms-Dos 3.3.