Zmiana
| Zmiana | |
|---|---|
| Type | File virus |
| Creator | |
| Date Discovered | OCT-1992 |
| Place of Origin | Warsaw, Poland |
| Source Language | |
| Platform | DOS |
| File Type(s) | .com, .exe |
| Infection Length | 1,458 bytes (com), 1,472 (exe), 1,456 (memory) |
| Reported Costs | |
Behavior
Zmiana, also known as Ha!, and Ornitho is a DOS virus that first appeared in Poland in 1992. Its name means "change" in Polish. When executed, it installs itself to the top of memory below the 640K DOS boundary. It will hook Interrupt 21 in memory. Zmiana infects .com and .exe programs as they are executed, including COMMAND.COM. The text "ha! version A" is visible in the file, but is not displayed at any point.
Variants
There are two variants that are 1,016 bytes along with a 1,224 byte one. They are relatively similar to the original. Some variants display "ha!" in a large font followed by "version A" below it.
Sources
Patricia Hoffman. Online VSUM, Ha Virus.
| One Zmiana variant in action |
|---|