Type File virus
Date Discovered 1992
Place of Origin Kiev, Ukraine
Source Language
Platform DOS
File Type(s) .com
Infection Length 3,321 Bytes
Reported Costs

Atas-II is a memory-resident DOS virus from Ukraine. It is distantly related to Atas, but different enough to be condsidered its own family. Both were discovered in Poland but originated in Ukraine.


When a file infected with Atas-II is executed, it becomes memory resident, moves interrupt 12's return, and hooks interrupts 08, 10, 16, 1C, and 21. It infects .com programs as they are executed, including, which it makes no effort to avoid. The virus body is appended to the file. It does not change the time and date of the file's last alteration.

 The Atas virus in action

The virus is encrypted and has stealth capabilities, hiding file increases while memory resident. When infected files are checked with chkdsk, the program will display file allocation errors. The virus contains the strings "bye <�> music", "letters", "display Bye-Bye", "========.===", and "ATAS Corporation.(B)1992,V1 Created in the Kiev by ATAS." encrypted in the virus body.

It may cause the system to hang. Also while in memory, if the user presses PrintScreen, all characters printed to the console will fall to the bottom of the screen.


A few variants exist, but none had any more impact than the original. These include:

  • Atas-II.1268
  • Atas-II.3215
  • Atas-II.3233
  • Atas-II.3321
  • Atas-II.384

Origin and Effects

Like its cousin Atas, Atas-II originated in Ukraine some time in 1992 and was first discovered in Poland in mid-1993. It was never particularly widespread and is not known to have caused much damage.

 An Atas informercial by danooct1


Patricia Hoffman. Online VSUM, Atas II Virus.

Unless otherwise stated, the content of this page is licensed under Creative Commons Attribution-NonCommercial-ShareAlike 3.0 License