Type File virus
Creator Masud Khafir
Date Discovered 1992.01
Place of Origin The Netherlands
Source Language
Platform DOS
File Type(s) .com
Infection Length 2,973 - 3,850 Bytes
Reported costs

Pogue is one of the early viruses to use the Dark Avenger Mutation Engine. It is also notable for playing music at certain times. Its creator went on to create the first Windows virus.


Pogue becomes memory resident when executed. It installs itself near the top of memory below the 640K DOS boundry. In memory, the virus consumes 9,728 bytes of memory.

Files with a .com extension are infected when they are executed, opened or copied. If an uninfected file is copied, both the source and the new file will be infected. It avoids infecting COMMAND.COM by ignoring any file beginning with the three letters COM. It appends its code to the end of the files resulting in a file from 2,973 to 3,850 bytes longer.

Pogue encrypts itself on most infected files. On a few files, the text "Pogue Mahone!", "TNX2DAV"or "Pgoue Mahone!" will be visible if they are unencrypted.

If the time is between 8:00 and 9:00, the virus will play music through the system speaker.

Other FactsEdit

This virus contains code from other viruses by Dark Avenger and TP, including 512, Eddie, Seventh Son, and Yankeedoodle. It was created by Masud Khafir, who would later that year create the Winvir virus. Probably because it is an early virus to use the Dark Avenger Mutation Engine, some virus researchers believed this virus originated in Bulgaria.


Patricia Hoffman. VSUM, 40Hex, Number 7, Volume 2, Issue 3, VSUMX 9204

Interview with Masud Khafir.