There are 2 variants:
When the virus is loaded into memory, it looks for any EXE executable that is run, and then it places a DOS executable having the same name by copying itself into it. No files will be infected.
Due to priority of running executables on MS-DOS, when the user runs the same program again, the virus will run first.
The following table shows the memory usage of the variants.
|Variant||Memory usage in bytes|
The virus triggers when the user attempts to run the antivirus program MSAV or MWAV.
This variant crashes the system by accessing an invalid part of memory when MSAV or MWAV is run, and no companion files will be added.
When MSAV or MWAV is run, instead of placing companion files, the virus deletes the program and turns the screen black, followed by hanging the system. A hard reset must be taken after this.
Lokjaw.Kenson.573 contains the internal text strings:
[ Its the KenSON III virus ] EXE COM For My Very Best Friend ...By Lobo 435 of Covina CA...
Lokjaw.Kenson.887 contains the internal text strings:
KenSON V - Lobo/435 BF! :) BstFrnd EXE COM For My Best Friend, the Fifth in a Series!!!