Class Virus
Platform DOS

Technical Details

It is not a dangerous memory resident parasitic virus. It traces INT 21h,
then hooks INT 9, 1Ch and 21h and writes itself to the end of COM and EXE
files, while infecting EXE files the virus converts them to COM format. At
the end of the infected files there is the text string:


This virus is a combination of different viruses: “Cascade” –
infecting the system memory, “VACSINA” – infecting EXE files,
“Yankee” – handling INT 21h, and of the program-joke “FACE.COM”
that is the origin of the virus’ video-effects. As a result, this virus has
fairly large size – about 30 Kb.

When any file is infected, the virus sets INT 9 (keyboard) and starts its
internal counter. The counter decrements its value by 1 on every keystroke.
When that counter reaches zero, a funny face appears on the screen.

Find out the statistics of the threats spreading in your region