SummaryWhen an infected file is executed, the virus will install itself
in memory and hook INT 21h. If the day is 5th of any month, virus
will also hook INT 8h (system timer).
The INT 21h handler intercepts calls to DOS function 4Bh (load program).
If the filename fits "*.COM" it is considered for infection. Only
those files that are smaller than 62.5kB and have no EXE 'MZ' header
are infected. Files which have the word 1972h at offset 3 are left
alone. Nothing is done about changing file attributes so if the virus
tries to infect files with read-only attribute, DOS will produce an
If the day was 5th of any month, virus will trigger some time after
the execution of an infected program. Depending on the video mode,
the virus may cause a scrolling effect on the screen or emit a beep
through the speaker.
Virus code contains a text saying 'Signs Of Life !'