There are 3 variants:
When the virus is run, it infects a number of DOS executable by writing itself to the end of these files.
This variant infects 1 or 2 files on each run, followed by activation. The actual infection size is 1,638 bytes.
This is the memory resident variant, it hooks INT 21h to infect any DOS executable that is run.
Programs infected by this virus might not function properly and hang or even crash the system.
This is a both TSR and non-TSR encrypted variant, it infects one file on each run, and it sets the initial generation as 0. It does not infect COMMAND.COM and files that are smaller than 1,000 bytes.
After being TSR, it still infects files in non-TSR way, i.e. run only infected files to spread.
The following table shows the memory usage of the variants.
|Variant||Memory usage in bytes|
After infection it displays a rather disturbing ASCII picture of a skull, with some text:
DEATHS HEAD VIRUS Abandon Hope All Ye Who Contract Me
The host program will run after that, but usually fails and might cause a system hang.
After a non fixed number of infections, the virus would crash the system.
On the 8th generation it displays the message and the host program will not be executed:
Bad command or file name
After that it becomes memory resident and hooks onto INT 9 (keyboard), the virus would use the same name that the program has been run in order to "hide" itself, consuming 736 bytes of memory. However if the host program is also TSR, it would become noticeable when using MEM detailed mode.
When the user attempts to reset the computer by issuing CTRL-ALT-DEL, the virus displays the following poetic message and hangs the computer:
Your PC has lapsed into a higher state of being... D E A T H Please, feel free to cold boot, as nothing has been damaged, it was only a near death experience Your PC should meditate more often, 'cuz with all the evil viruses flowing around neurospace we wouldn't want this to become a real D E A T H [Death] The Attitude Adjuster, VG, 12/02/92
Death.638 contains the internal text string:
Death.725 contains the internal text string:
I`m coming back I will return Svilena S. [Death]