There are 5 variants in 2 versions, represented by the following:
When activated, the virus shows a black Swastika on a red background. It hooks INT 21h and writes itself to the end of DOS executable files.
Cybercide.1288, 1307, and 1321
These variants store the names of the files on DOS calls FindFirst/FindNext and OpenHandle. On call to DOS function GetDiskSpace they infect the files that are stored. They hit the files on DOS call CloseHandle also. Along with 1309, they erase the disk sectors.
Cybercide.2229 and 2256
These variants hit the files on FindFirst/FindNext DOS calls only. On opening the infected file the viruses disinfect it. They hook INT 09h, 1Ch also and call trigger routine from these handlers. On typing "anoi" on keyboard these viruses add "iS AROUND!", on pressing Alt-Del they display chars 'A', 'N', 'O' and 'I' in four corners of the screen. Depending on system timer they either displays color cross in background (looks as Swedish national flag), or play the tune (the Imperial March from The Empire Strikes Back) and display the message and then halt computer, or erase random selected disk sector by the string:
>>> A.N.O.I <<<
Cybercide.1288, 1307, 1309, 1321 would also erase the disk sectors.
These viruses contain the internal text strings also (some of them are written backward in "Cybercide.2229,2256"):
huh huh m huh m huh hu hu hu huh huh huh m huh mhu huh hu huh huh Im going to kick your *ss again (c)1995 Etheopia Virus: Butt-HeadAuthor: Etheopia/FLooD Uhhhh, Hey baby..
Foul language words are not censored in the real virus.
Cybercide.1307 and 1309
Simple Simon met a pieman going to the fair said Simple Simon to the pieman let me take your ware (c)1993 Cruel Entit %%% MY LITTLE PONY %%% COPYRIGHT(C) 1993 A.N.O.I. %%% >>> A.N.O.I <<<
simple simon met a pieman going to the fair said simple simon to the pieman let me take your ware - my little pony - copyright(c) 1993 Cruel Entity and A.N.O.I. - .. sweden rise again ..
Cybercide.2229 and 2256
nam nesut agnåm dem änk mo änk ,marfkcig xeR sluloraC ruh nes egnäl röf ,nä in snniM YTITNE na ot LEURC eb reven ynollef ELIV a si GINKLAWYAJ ... I SHALL FEAR NO EVIL ... **CYBERCIDE** -- FLOATING THROUGH THE VOID -=CYBERCIDE=- 01-30-1993 * COPYRIGHT (C) 1992-93 A.N.O.I DEVELOPMENT
There are 5 variants in this family: