| Atas-II | |
|---|---|
| Type | File virus |
| Creator | |
| Date Discovered | 1992 |
| Place of Origin | Kiev, Ukraine |
| Source Language | |
| Platform | DOS |
| File Type(s) | .com |
| Infection Length | 3,321 Bytes |
| Reported Costs | |
Atas-II is a memory-resident DOS virus from Ukraine. It is distantly related to Atas, but different enough to be condsidered its own family. Both were discovered in Poland but originated in Ukraine.
Behavior
When a file infected with Atas-II is executed, it becomes memory resident, moves interrupt 12's return, and hooks interrupts 08, 10, 16, 1C, and 21. It infects .com programs as they are executed, including command.com, which it makes no effort to avoid. The virus body is appended to the file. It does not change the time and date of the file's last alteration.
| The Atas virus in action |
|---|
The virus is encrypted and has stealth capabilities, hiding file increases while memory resident. When infected files are checked with chkdsk, the program will display file allocation errors. The virus contains the strings "bye <> music", "letters", "display Bye-Bye", "========.===", and "ATAS Corporation.(B)1992,V1 Created in the Kiev by ATAS." encrypted in the virus body.
It may cause the system to hang. Also while in memory, if the user presses PrintScreen, all characters printed to the console will fall to the bottom of the screen.
Variants
A few variants exist, but none had any more impact than the original. These include:
- Atas-II.1268
- Atas-II.3215
- Atas-II.3233
- Atas-II.3321
- Atas-II.384
Origin and Effects
Like its cousin Atas, Atas-II originated in Ukraine some time in 1992 and was first discovered in Poland in mid-1993. It was never particularly widespread and is not known to have caused much damage.
| An Atas informercial by danooct1 |
|---|
Sources
Patricia Hoffman. Online VSUM, Atas II Virus.