The INT 21h handler defines the residence test and intercepts DOS
function 4B00h (load/exec) to infect files. Files with an EXE header are
excluded by testing for 'MZ' as the first word of the file. Files larger
than 62.5 KB are also ignored. If a victim file start with a jump to
a location of 1241 bytes before the end of the file, virus concludes
that the file is already installed. File attribute is cleared and
restored afterwards. File date/time are preserved. Infection is done by
appending the virus.
Virus checks the system data. If the date is November 1991 or later and
it is the 19th of an even-numbered month, a text message is decrypted (with
XOR 0B5h). The message reads:
Arbeiten Sie jetzt wirklich umweltfreundlich ?
Sie haben nun viel Zeit darber nachzudenken !
Es grsst Sie die "Grne Partei der Schweiz" !
The damage routine reads the disk system parameters (INT 13h/AH=8h) and
the partition and boot sectors to get the disk parameters. All
partitions on all hard disks have their system area overwritten
with garbage from memory location 1000:0000h. Then the message is
printed on the screen. When the message is displayed for the first
time, data on disks is lost already.
Next each hard disk is completely overwritten (all sectors from
beginning to end of physically formatted area) with the same garbage,
and the message is printed once more for each disk. A maximum of 4
attempts are made at each disk operation.