There are 5 variants in 4 versions, represented by the following:
When the virus is loaded into memory, it hooks INT 8 and 21h to infect any DOS executable file that is run.
BackTime.496 might not restore the registers when INT 8 is called.
Debugging is required for BackTime.527 for its runtime, otherwise it would print an "S" and exit directly without staying memory resident. BackTime.528 is the bug fixing release.
BackTime.1234 also drops the virus Stoned.Michelangelo to the boot sector when it is run, and the dropped virus consumes 2K of memory.
The following table shows the memory usage of the variants.
|Variant||Memory usage in bytes|
This variant does not manifest itself.
This variant manifests itself on CGA-adapter only, it "shakes" the screen.
BackTime.527 and 528
This virus sets the system timer in back direction, when the INT 8 is called the virus decrements the content of timer counter. At a result the programs that uses the timer characteristics of computer (like a BenchMarks) are hang-up.
The virus does not change the time in CMOS memory, when the computer is rebooted, the time would return normal, if the virus is not loaded.
This variant does not manifest itself, while the dropped virus does on March 6th.
This family has 5 variants in total:
BackTime.496 contains the internal text string:
BackTime.512 contains the internal text string:
BackTime.527 and 528 contain the internal text string: