This virus activates in January 1993. During this month, it overwrites
programs with a trojan.
When the virus infects a file, it stores the current system timer
value to low system memory. On the next execution of the virus,
it checks that at least 64k timer counts have passed before it
The virus checks the current drive, and if it is operating on a floppy,
it tries to change the drive to C:. On all drives from C: to the current
drive, all directories from the root are recursively scanned for files
matching "*.COM". These files are then either infected or damaged,
depending on the date. Files named "MKS_VIR.COM" or "COMMAND.COM" are
The virus infects files by storing the beginning of host files to
the end of file and replacing the beginning with it's own code.
When the virus exits the copy routine restores the original program and
jumps to it. The file attribute has read-only and hidden bits cleared
during infection and restored afterwards. File date/time are (partly)
preserved, except the low byte is set to 0FFh (seconds=62, minutes can
become 63 if the previous minutes value was 56). Files with the low byte
of the filetime as 0FFh are considered already infected and skipped.
The damage routine only destroys files if the file's creation time's
hour field is even. When files are damaged, the beginning of the file is
overwritten by a little program that writes "Program terminated
normally" to the screen. Also, the hour filed is changed to odd.