Type Virus
Creator ANAX
Date Discovered 1997
Platform Microsoft DOS
File Type .COM, .EXE
Alias Virus.DOS.Vanitas.2040
Virus.DOS.Vanitas or Vanitas is a virus that runs on MS-DOS.

This virus has 2 versions :
  • Virus.DOS.Vanitas.2040;
  • Virus.DOS.Vanitas.3712.


Vanitas is a memory resident encrypted parasitic virus.

It hooks INT 21h (DOS Function Dispatcher) and writes itself to the end of .EXE files that are accessed (infects .EXE files that are accessed).

The virus does not infect the files: EMM386, SCAN, F-PROT.

While installing memory resident the virus also infects the C:\WINDOWS\COMMAND.COM and C:\COMMAND.COM files (they are of EXE format in DOS 7.x). The virus has a bug and may halt the system while installing memory resident.

The virus contains the text strings:

VANITAS++ v2.0 GR(c)97 by ANAX.
[E-75] goes to Hell. Have a nice death...

On March 27th, the virus manifests itself by a video effect shown in the video below :