Virus.DOS.Death is a parasitic virus on DOS. There are 3 variants:

  • Virus.DOS.Death.638
  • Virus.DOS.Death.725
  • Virus.DOS.Death.1001


When the virus is run, it infects a number of DOS executable by writing itself to the end of these files.


This variant infects 1 or 2 files on each run, followed by activation. The actual infection size is 1,638 bytes.


This is the memory-resident variant, it hooks INT 21h to infect any DOS executable file that is run. Programs infected by this virus might not function properly and hang or even crash the system.


This is a both TSR and non-TSR encrypted variant, it infects one file on each run, and it sets the initial generation as 0. It does not infect COMMAND.COM and files that are smaller than 1,000 bytes. After being TSR, it still infects files in a non-TSR way, i.e. run only infected files to spread.

Advanced details

The following table shows the memory usage of the variants.

Variant Memory usage in bytes
Death.638 Non-TSR
Death.725 4,512
Death.1001 736

MD5 hashes:

Variant Hash
Death.638 6c7f442db78ebfd49553191d9d7e3dd9
Death.725 c7f7255b3ae7744eb601a904d927711a
Death.1001 f36ff07b6a800cc65ded7443fa958722



After infection it displays a rather disturbing ASCII picture of a skull, with some text: DEATHS HEAD VIRUS Abandon Hope All Ye Who Contract Me The host program will run after that, but usually fails and might hang the system.
Death638 payload

The payload of Death.638, followed by the host program.


After a non-fixed number of infections, the virus would crash the system.


On the 8th generation, it displays the message and the host program will not be executed: Bad command or file name After that it becomes memory resident and hooks onto INT 9 (keyboard), the virus would use the same name that the program has been run in order to "hide" itself, consuming 736 bytes of memory. However, if the host program is also TSR, it would become noticeable when using MEM detailed mode.
Death1001 TSR

The virus uses the name of the host program to stay in memory, but it would be revealed if the host is also TSR.

When the user attempts to reset the computer by issuing CTRL-ALT-DEL, the virus displays the following poetic message and hangs the computer: "Your PC has lapsed into a higher state of being... D E A T H Please, feel free to cold boot, as nothing has been damaged, it was only a near-death experience Your PC should meditate more often, 'cuz with all the evil viruses flowing around neuro space we wouldn't want this to become a real D E A T H [Death] The Attitude Adjuster, VG, 12/02/92"

Other details

Death.638 contains the internal text string: ????????COM *.com Death.725 contains the internal text string: "I`m coming back I will return Svilena S. [Death]"


  1. List of variants of the Death virus on VX Heaven


Death DOS Virus

Death DOS Virus

Death virus review by Alles Sandro

Community content is available under CC-BY-SA unless otherwise noted.