Summary

This virus activates in January 1993. During this month, it overwrites programs with a trojan.

When the virus infects a file, it stores the current system timer value to low system memory. On the next execution of the virus, it checks that at least 64k timer counts have passed before it infects again.

The virus checks the current drive, and if it is operating on a floppy, it tries to change the drive to C:. On all drives from C: to the current drive, all directories from the root are recursively scanned for files matching "*.COM". These files are then either infected or damaged, depending on the date. Files named "MKS_VIR.COM" or "COMMAND.COM" are ignored.

The virus infects files by storing the beginning of host files to the end of file and replacing the beginning with it's own code. When the virus exits the copy routine restores the original program and jumps to it. The file attribute has read-only and hidden bits cleared during infection and restored afterwards. File date/time are (partly) preserved, except the low byte is set to 0FFh (seconds=62, minutes can become 63 if the previous minutes value was 56). Files with the low byte of the filetime as 0FFh are considered already infected and skipped.

The damage routine only destroys files if the file's creation time's hour field is even. When files are damaged, the beginning of the file is overwritten by a little program that writes "Program terminated normally" to the screen. Also, the hour filed is changed to odd.