There are 18 variants in 3 versions, represented by the following:
When the virus is run, it infects every DOS executable in current directory.
7son.284, 286...333.b, 334 and 350Edit
These variants infects every DOS executable in current directory except those having the size smaller than or equal to 1,000 bytes.
This variant infects every DOS executable in current directory, followed by running into an invalid opcode, which would lead to a system hang or the process to be killed (DOS 7.1).
Every time an infected file is run, a memory dump file is placed in root directory, having a random filename and no extension.
All these variants cannot infect files that are larger than 64KB.
This family has 18 variants in total:
- Virus.DOS.7son.284 (A, B, D and E)
- Virus.DOS.7son.332 (plus B and C)
- Virus.DOS.7son.333 (A, B and C)
There are no valid samples for 7son.333.c and 344 but the non-runnable joke programs, while some of the antiviruses still identified them as variants of 7son.
The virus contains the internal text string:
Seventh son of a seventh son *.COM