There are 6 variants:
- Virus.DOS.Immortal.2174 (A, C, D and F)
When the virus is loaded into memory, it traces and hooks INT 21h, and then it writes itself to the end of the files that are accessed.
When an infected program is run, the virus hides itself from some files which have been infected in the same section to make them appear to be disinfected, while the others that are also infected but not executed remain unchanged, as long as it stays in memory.
The timestamp of an infected file may also be modified by rolling back 28 years if the year of the original one is 2000 or afterwards.
The following table shows the memory usage of the variants.
|Variant||Memory usage in bytes|
|Immortal.2174 (A and C)||80^|
|Immortal.2174 (D and F)||2,384|
^Execution failed but still captured
On December 22nd, the virus activates with a visual effect, and display the following message in large white letters at the top of the screen with font that resembles that of IBM:
The payload activates only once on every section.
Immortal.1894 displays the letters in white while that in Immortal.2174.d and f are in red.
There is a family of variants with the same name that belongs to the Riot family, having 21 variants and their infection sizes in a range of 264 to 589 bytes, but there is no relationship between this family and that in Riot.
There are programming faults which would access to other disk sectors during execution in variants 2174.a, c and 2185, any host program infected by any of these variants will never execute anymore due to the segmentation fault, debugging is required.
Immortal.1894, 2174 (A, D and F) and 2185 the internal text string:
IMMORTAL (c) 1994 by MW
Immortal.2174.c contains the internal text string:
IMMORTAL (c) 1995 by RH