Virdem was the first file virus for MS-DOS.[1] It was written by Ralf Burger in 1986 as a demonstration program for Chaos Computer Club conference. The virus spreads by attaching itself to files with the .COM file extension. It is one of the oldest viruses for MS-DOS computers.[2]
In December 1986, Burger distributed the virus at the Chaos Computer Club conference in Hamburg, Germany.[3] The virus could copy itself and attach that copy to any .COM files. Virdem was fairly harmless [4]
Virdem overwrites the host with its own code and saves the original program at the very end. It was a direct-action virus It only infected files that had a COM extension.[5] When an infected file is run, the next uninfected program becomes infected.
When infected, small COM files, less than 11k, grow by 2559 bytes and larger files grow by 1336 bytes. Infected programs ask to guess a number between is the generation number of the virus plus one. If you guess correctly, the program runs if not, it returns to DOS.
It doesn't intercept interrupt 24h so a write-protected disk will give an "Abort, Retry, Ignore" message. Read-only files are set to read/write, infected and then not set back to read-only. The virus had two NOP instructions at the beginning of the file.[6]