Threat description




This virus activates in January 1993. During this month, it overwrites programs with a trojan.

When the virus infects a file, it stores the current system timer value to low system memory. On the next execution of the virus, it checks that at least 64k timer counts have passed before it infects again.

The virus checks the current drive, and if it is operating on a floppy, it tries to change the drive to C:. On all drives from C: to the current drive, all directories from the root are recursively scanned for files matching "*.COM". These files are then either infected or damaged, depending on the date. Files named "MKS_VIR.COM" or "COMMAND.COM" are ignored.

The virus infects files by storing the beginning of host files to the end of file and replacing the beginning with it's own code. When the virus exits the copy routine restores the original program and jumps to it. The file attribute has read-only and hidden bits cleared during infection and restored afterwards. File date/time are (partly) preserved, except the low byte is set to 0FFh (seconds=62, minutes can become 63 if the previous minutes value was 56). Files with the low byte of the filetime as 0FFh are considered already infected and skipped.

The damage routine only destroys files if the file's creation time's hour field is even. When files are damaged, the beginning of the file is overwritten by a little program that writes "Program terminated normally" to the screen. Also, the hour filed is changed to odd.


Automatic action

Depending on the settings of your F-Secure security product, it will either automatically delete, quarantine or rename the suspect file, or ask you for a desired action.

More scanning & removal options

More information on the scanning and removal options available in your F-Secure product can be found in the Help Center.

You may also refer to the Knowledge Base on the F-Secure Community site for more information.

Contact Support

F-Secure customers can request support online via the Request support or the Chat forms on our Home - Global site.

Submit a Sample

Suspect a file or URL was wrongly detected? Send it to our Labs for further analysis

Submit a Sample

Give And Get Advice

Give advice. Get advice. Share the knowledge on our free discussion forum.

More Info