Type Multipartite virus
Creator Dark Avenger
Date Discovered 1990.07
Place of Origin Sophia, Bulgaria
Source Language Assembly
Platform DOS
File Type(s) .com, .exe
Infection Length 1040-1279 bytes
Reported Costs

Anthrax is a multipartite virus created by Dark Avenger. While it was created in Bulgaria, it was first isolated in the Netherlands.The virus was named after the Trash metal band of the same name.


On the first time a file infected with Anthrax is executed, the virus writes itself to the hard disk partition table as well as the last few sectors of the hard disk. For this initial infection, it will not infect any files or become memory resident.

When the hard disk is booted, the virus then becomes memory resident. When a file is executed, the virus infects a file closest to the root of the hard disk. When the newly infected file is executed, it will infect another .com or .exe file, again, starting from the root of the hard drive and searching for uninfected files. If the infected file is located on a floppy drive, it may or may not infect a file.

The V2100 virus will resurrect an infection of Anthrax if Anthrax has been removed. When it finds the copy of Anthrax on the last few sectors, it places it on the partition table.

There are three text strings in the file: "(c)Damage, Inc.", "ANTHRAX" and "Софиа 1990". The last one is "Sofia", the capital of Bulgaria and home of Dark Avenger.


Andrzej Kadlof, Virus Information Bank; Matthias Jaenichen, University Hamburg, Virus Test Center. Computer Virus Catalog 1.2: Anthrax Virus. 1992.07.25

Patricia Hoffman. 40Hex, Volume 1, 40Hex Issue 3, Anthrax. 1991.10

Unless otherwise stated, the content of this page is licensed under Creative Commons Attribution-NonCommercial-ShareAlike 3.0 License