Natas is arguably a 'superstar' of a virus, with an unlimited target infection area. Thousands of computers have been hit by it, and there are still an unknown number of infected PCs about, notwithstanding the fact that practically all popular anti-virus scanners have been updated to detect it. Installation When a Natas-infected file is executed, control passes to the end of the file where the polymorphic decryption routine is located. This code decrypts the body of the virus and passes control to the installation routine. Control returns to the host program if the TSR copy is loaded, or if the version of DOS present is under 3.0.
Installation continues with a tunnelling routine.
Using these tracing results, the virus hooks Int 13h and Int 21h by storing five bytes of both interrupt handlers and overwriting the entry point of the code with a FAR JMP to the virus. One interesting feature of this virus is that the loader code will be placed in different offsets according to the contents of each boot sector. If there is no JMP, the virus simply overwrites the beginning of the boot sector. When loading from an infected MBS or floppy boot sector, the virus decreases the size of conventional memory as held by the BIOS, reads its own saved body from disk, hooks Int 13h, decrypts itself, and passes control to the original MBS or boot sector. Natas will infect the MBS on loading from an infected floppy, and on execution of an infected file.