There are 9 variants in 5 versions, represented by the following:
When the virus is executed it first checks the DOS version and installs itself as memory resident if the version is 5.0 or above. If there is free block of upper memory, this virus copies itself into UMB. This virus infects files on FindFirst/FindNext DOS calls. On opening an infected file the virus disinfects it.
The virus hooks INT 3, 15h, 21h. INT 3 is used as decryption routine, INT 15h handler calls trigger routine, INT 21h handler calls infection routine, and writes itself to the end of the file that are executed.
MTZ.971 and 1907 Edit
These variants infect DOS executable.
MTZ.2501 and 2624 Edit
These variants infect EXE executable.
Not every variant that would activate.
This variant does not manifest itself at anyway.
This variant activates when the user issues CTRL-ALT-DEL, it displays a graphical effect with noises and the message:
Y.K.K. - (c) M T Z - Italy! Good Luck Today
The complete list of variants of the MTZ family: