Type File virus
Date Discovered 1992-08
Place of Origin Kiev, Ukraine
Source Language
Platform DOS
File Type(s) .com
Infection Length 384 Bytes
Reported Costs

Atas is a small family of Ukrainian viruses appearing in 1992. It is likely from the same creator of Atas-II, a somewhat similar memory-resident version.


When a file infected with Atas is executed, it infects one clean .com file in the current directory, appending its 384 bytes to the file. The file's modified time and date will change to the time the infection occurred. The strings "*.COM Ok." and "ATAS V0.1 Cr.24.01.92" can be found in the virus body if it is unencrypted. The text "Ok" may appear when infected .com files are executed.


Atas.400 was also first discovered in Poland at about the same time as Atas.384. This variant is functionally similar to the 384 byte version. It contains the text "*.COM I like to travel…" and "ATAS(Kiev) V3.03 Cr.91.10.11". The version number in the text body suggests it was created after the 384 byte version, however if "91.10.11" is a YY.MM.DD date format (common in Hungary and Asia but not often used in either Ukraine or Poland) it may predate it.

Other variants include Atas.1268, Atas.3215, and Atas.3321.

Origin and Effects

Atas was first discovered in Poland in summer of 1992, but text found in the virus body reveals it comes from Kiev, in Ukraine. It was reportedly rare, and not known to have spread much out of eastern or central Europe. It has a distant cousin virus known as Atas-II, though probably from the same creator, is functionally very different.


Patricia Hoffman. Online VSUM, Atas Virus.

Unless otherwise stated, the content of this page is licensed under Creative Commons Attribution-NonCommercial-ShareAlike 3.0 License