FANDOM


Virus.DOS.Chris.463 or Chris is a memory resident infector of .COM programs, including COMMAND.COM.

Payload

When the first Chris infected program is executed, the Chris virus will install itself memory resident in available system memory, hooking interrupt 21. Total system and available free memory, as indicated by the DOS CHKDSK, will not be altered. 

Once memory resident, the Chris virus will infect .COM programs when they are executed. Infected programs will have a file length increase of 463 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory listing will have been updated to the current system date and time when infection occurred. One text string is visible within the viral code in infected programs which is blank.

The following text string is encrypted within the viral code:

Mary,.... ti AMO!

This second text string is occassionally displayed by the virus as a message on the system monitor, accompanied by beeping.  When the message is displayed, a system hang may also occur. Infected programs may not function properly as a result.

Removal

Delete the infected files.

Community content is available under CC-BY-SA unless otherwise noted.