The virus is slightly polymorphic and uses several layers of
self-encrypton. Infected EXE files are converted to COM type.
The virus either inserts its body into the victim file or appends
it to the end of the file. When resident, the virus occupies 8 Kb
of memory in highest addresses below 640K boundary. After certain
number of reboots of an infected system the virus trashes data on
the first cylinder of a hard disk (Boot sector and FAT) and displays
the following message:
![](/images/pixel.gif"){kind=tracking}
