There are 2 variants:
When the virus is run, it activates, followed by overwriting the first EXE executable, and makes a copy of this infect file to the parent directory. It also overwrites an DOS executable.
This variant overwrites ROMMAND.COM located in parent directory, if no such file exists, the virus creates it.
After an infection, the virus changes the current directory to one upper level.
This variant tries to overwrite C:\COMMAND.COM instead, but due to some programming faults, it fails and terminates. This also makes the upcoming commands of copying the infected EXE file and changing the current directory to one upper level not to run.
These are non-memory resident variants so that they left nothing in memory after execution.
The virus plays a tune and display a full screen message in ASCII art:
I am THE EDWIn CLETOn VIRUS... AnD I LOVE A GOOD "HARD" DRIVE
And also a text message belows it:
...Ahhhh! Get a ROD just thinking about it!
The ASCII art of "EDWIN CLETON" and the quote have the flashing effect.
All of these variants contain the internal text strings:
*.exe .. CES (c) Controlled Environment Simulator Edwin Cleton 1993 VirSoft (c)
Abraxas.Cleton.1508 also contains the internal text strings:
rommand.com Darkest Avenger
Abraxas.Cleton.1518 also contains the internal text strings:
c:\command.com Glenn Jordon - VirexPC
- List of variants of the Abraxas.Cleton virus on VX Heaven