Threat description




Filehide causes the files in the current directory to be hidden on fridays.


Automatic action

Depending on the settings of your F-Secure security product, it will either automatically delete, quarantine or rename the suspect file, or ask you for a desired action.

More scanning & removal options

More information on the scanning and removal options available in your F-Secure product can be found in the Help Center.

You may also refer to the Knowledge Base on the F-Secure Community site for more information.

Contact Support

F-Secure customers can request support online via the Request support or the Chat forms on our Home - Global site.

Technical Details

The virus only works if the major number of DOS version is higher than 1 and the minor number is higher than 2. Virus uses INT 21h/AX=A1D5h as an "Are-you-there" call. If AH=900Dh is returned, the virus is resident. Virus allocates 800 bytes of memory using DOS alloc functions. The 789 bytes of the viruscode is copied there. Execution continues in the copy.

When virus hook INT 21h, it checks the first byte of the original interrupt handler. If it is PUSHF, the whole INT 21h segment is searched for the first occurence of the command JMP FAR [####] and the destination vector is fetched from there.

This is repeated as many times as possible. The intention is to get an INT 21h vector which is not exiting via JMP FAR [####]. Using this method, it is very easy for the wrong vector to be fetched, if such far-jumps exist in the searched segments.

The virus revectors INT FFh to point to original INT 21h handler, and uses INT FFh to access DOS. The INT 21h handler of the virus exits to DOS by pushing the previous vector and doing IRET (the flags are already on the stack because the first instruction of the handler is PUSHF).

The virus is kept resident by fiddling in the DOS data table returned by INT 21h/AH=52h.

The INT 21h handler defines the residence test and intercepts DOS functions 4B00h (load/exec) and 3Dh (open file) to infect files. Only COM files are infected. Virus checks that there is enough available disk space left for the infection. File attribute is cleared and date/time are preserved except the seconds field is set to 58 after infection. This is used to prevent reinfection.

Files will only be infected if they are smaller than 62 KB. Infection is done by appending the viruscode to the host file. Before returning from the intercept routine (whether or not infection took place), the system date is checked and if it is a friday there is a 1:16 chance that all files in the current directory will be hidden (1:4 chance if it is friday 13th).

Submit a Sample

Suspect a file or URL was wrongly detected? Send it to our Labs for further analysis

Submit a Sample

Give And Get Advice

Give advice. Get advice. Share the knowledge on our free discussion forum.

More Info