When the virus is running, it searches for every MZ executable file, and then copies itself and rename as the filename that it searched for, in COM format.
The companion files always have a size of 4,752 bytes, and the timestamp of the new files are the same as that from the source.
The virus ignores the programs that already had a companion file.
The virus does not stay memory resident after execution.
For any companion file dropped by the virus, if the EXE file sharing the same filename has been moved, deleted or simply not exist, running this file will output a message, and search for any new programs that have no companion file to copy:
Guest by Dirty Nazi/SGWW. 4 PVT only!
Plus some unreadable characters.
The virus contains the internal text strings:
COMSPEC /C COPY /B .EXE COMSPEC /C