There are 2 variants:
When the virus is loaded into memory, it first beeps from the system speaker, and then returns to DOS.
After that the virus hooks INT 8, 13h and 21h, and then it infects any DOS executable that is run, and sometimes hangs the system.
The virus does not infect files smaller than itself. In the case of Ada.2600, the virus simply ignores the file; while that of Ada.3368 would crash the system when it tries to infect them.
The following table shows the memory usage of the variants.
|Variant||Memory usage in bytes|
When the virus is in memory the system speaker would emit a click sound in periods, and the sound may sometimes change in pitch.
Infected systems might show a "Disk full" error even there are free space available.
Ada.2600 contains the internal text string:
COMMAND.COM PCCILLIN.COM PCCILLIN.IMG HATI-HATI !! ADA VIRUS DISINI !!Delete
Ada.3368 contains the internal text string:
exeMAND.EXE PCCILLIN.COM PCCILLIN.IMG PCCILLIN.exe HATI-HATI !! ADA VIRUS DISINI !!Delete basura
(Last sentence) Which translates to:
WATCH OUT !! HERE IS NO VIRUS !!Delete trash
Description of the Ada virus, Online VSUM