There are 2 variants:
When the virus is loaded into memory, it hooks INT 21h and infects any executable that is run by writing itself to the end of the file.
The infection size varies in different files.
The following table shows the memory usage of the variants.
|Variant||Memory usage in bytes|
The virus activates on Thursday 12th (followed by Friday 13th).
On every 4th execution of an infected program on this day, the virus displays a message in red background:
VirCheck V1.2 (c) 1991 Be aware of those worms out there, violating your machine on Friday 13th - it's tomorrow! Special thanks to Ross M. Greenberg, Patricia M. Hoffmann and John McAfee Press any key to continue...
And then the host program would run as usual after a keypress.
There is no relationship between the term Compact Disc (CD in short, a secondary storage medium) and the alias of this virus.
This virus is also called Thursday The 12th. Concerning the message in the payload, the virus actually does nothing other than infecting files on Friday 13th.
About the alias
CD is a command on DOS, having a meaning of "Change Directory", it can also be used to display the current position by typing it without parameters:
If an executable file is named as "CD", the user will need to issue the following command in order to let the program run:
Which ".\" represents the current directory, making it possible to run the file.