Virus.DOS.TPE.Ukraine

Virus.DOS.Ukraine is a dangerous memory resident parasitic encrypted virus on DOS.

There are 12 variants in 4 versions, represented by the following: When the virus is loaded into memory, it hooks INT 21h to infect any executable that is run. No file size change can be observed as long as the virus stays in memory.
 * Virus.DOS.Ukraine.3201  Hqdefault.jpg
 * Virus.DOS.Ukraine.3400
 * Virus.DOS.Ukraine.3426.b
 * Virus.DOS.Ukraine.3537

The virus might corrupt files during infection that a system hang may cause when an infected program is run.

Ukraine.3400 does not infect EXE files.

The virus activates on 24th day in any month, except Ukraine.3426.b and 3537.

When any program is run when the virus is in memory, a full screen ASCII image of Ukrainian flag with the Tryzub (Ukrainian for "Trident", the symbol in the coat of arms of said nation) is displayed and the national anthem of Ukraine (Shche ne vmerla Ukraina) is played in the 8 bit style.

After a while, a text is displayed at the bottom of the screen: 24 СЕРПНЯ - ДЕНЬ НЕЗАЛЕЖНОСТІ УКРАІНИ !!! Translation (from Ukrainian): 24 August - INDEPENDENCE DAY of UKRAINE!!! Ukraine.3400 is a cracked version of the virus.

The infection size of Ukraine.3633 is 3,624 bytes instead of 3,633 bytes.