There are 2 variants:
When the virus is loaded into memory, it hooks INT 21h to infect any DOS executable that is run or accessed by FindFirst (AH=4Eh) by writing itself to the beginning of the file.
The virus is unable to infect files smaller than 1,024 bytes, in such case when these files are run, the virus simply ignores them. If a file listing command is issued, the virus might crash the system on attempting to infect these files.
The following table shows the memory usage of the variants.
|Variant||Memory usage in bytes|
The virus encrypts only the internal text strings, not its code.
04h.609 contains the encrypted internal text string:
04h Virus, (c) Enrico*.com
04h.635 contains the encrypted internal text string: