MkS_Vir and AVG shipped DOS virus zoos with defanged viruses you could watch, including one that flushed your screen like a toilet

Your antivirus used to come with a petting zoo. In the DOS days, a couple of antivirus programs shipped with real viruses that had been defanged, so you could sit there and watch what the nasty things did without your machine paying for it.

Marcin Wichary found one of them in Poland. MkS_Vir, named after its creator Marek Sell, was the country’s most popular antivirus, according to his post on the Unsung blog. It cleaned infected machines, and it also held what he calls a “virus zoo.” Wichary emulated it, and the zoo still runs.

The exhibits are a gag reel. One virus occasionally turned every letter uppercase. One rotated your screen on Fridays (a very on-brand 1990s workweek). One showed flames a month after infection and left the computer unbootable. One laughed at you. One waited three months, then ate your letters. Then the classics: letters that fall down the screen, and a virus that flushes your display like a toilet.

That last one is the dad joke the entire category was waiting for. A virus that flushes your screen is, technically, a bug in the plumbing.

Wichary’s own take is that these look cute now, but they could frighten new users who didn’t know whether a computer was supposed to behave like that. Falling letters on your own screen would shake anyone.

The Czech antivirus AVG had a zoo of its own. Wichary points to a YouTube walkthrough of AVG’s zoo that runs many of the effects in a row. So this was not one eccentric Polish programmer. At least two antivirus makers in Central Europe decided the best way to explain a virus was to let it perform.

Think about what that means as a sales pitch. Today’s security products show you a green checkmark and a subscription renewal notice. MkS_Vir showed you a toilet flush. Only one of them ever made anyone laugh (guess which).

The other reason this matters is where the fun lives. Malware that announces itself is a different animal from what shows up now, and it is the reason the old effects work as museum pieces. Wichary notes that some viruses mainly wanted to spread, and some announced themselves with sound and visuals. Nothing in a modern infection wants you to notice it.

Hypponen’s museum makes the same point from the other direction. Its entries are not screenshots or videos. They are actual emulated malware, which Wichary says emulation sandboxes and careful preparation likely made harmless. A sandbox is the modern version of the zoo’s glass: the virus can still perform, and it can’t get out.

The museum idea could easily spread. Emulation is cheap, the old effects are funny, and every year fewer people remember what they looked like firsthand. A browser-based zoo you scroll through like a gallery is the obvious next exhibit, and Wichary’s emulated MkS_Vir is already most of the way there.

The toilet flush, at least, never came with a subscription.