When an infected file is executed, the virus goes memory resident
and hooks three interrupts, 8h (timer), 9h (keyboard) and 21h (DOS).
INT 8h increments an inactivity timer and INT 9h resets it. If no
keyboard input occurs for about 30 minutes, a dialog box is put up on
the screen and is removed at the next keystroke or after a further 30
minutes inactivity. The dialog box contains some unknown foreign text
and it is encrypted in the virus code.
If the virus is active in memory, it will infect all files which are
either executed or opened or their attributes changed. Infection is
attempted on files in the current directory (including hidden files),
matching either *.CO? or *.EX?. Virus also checks whether the file
begins with AI*.* and if it does, the virus will not infect it.
Non-EXE files are not infected if they're smaller than 1kB or larger
than 60kB. The infection signature is 0FCh as the last byte of the
file. Virus adds 100 years to the years field in the file date and
zeroes the second field. If the free disk space is less than 4
sectors, virus will not attempt infection.
