There are 4 variants:
When the virus is loaded into memory, it hooks INT 21h and 6Bh to infect any DOS executable that is run or being loaded for debugging purposes.
While creating a TSR copy, the virus does not modify the MCB chain, making it to crash the system, so debugging of the virus is required.
The infection size of 10past3.a is 748 bytes while that of 10past3.b is 789 bytes.
When the system time is between 15:00 and 15:15, the virus hooks INT 9 to interfere the keyboard input, by randomly issuing CTRL or Shift on key presses.
Additionally, the virus also disables or interferes the hardware functions on these days in any month:
- 1st - keyboard
- 10th - hard disk
- 16th - display
- 29th - disk drives (floppy, CD-ROM)
When an infected program is run on 22nd of any month, the system might reset.
10past3.b contains the internal text string:
Online VSUM, 10 Past 3