When the virus is loaded into memory, it hooks INT 5, 8, 13h, 17h, 21h to infect any executable, on DOS calls CloseFile it also searches for them to infect. The virus writes itself to the beginning of DOS executable files, while that of EXE files are infected by companion manner.
On July 3rd the virus hooks INT 8, after an amount of time it displays an ASCII cake and a message, as well as playing a tune of Happy Birthday:
Today is my birthday, and I'm very tired, so let me take a short rest !! ** Please turn the power off. **
And hangs the system.
When the computer is rebooted, the hard drive will be formatted.
The virus contains the internal text strings:
<<< MURDERER Version 1.44 >>> IBMBIO.COM IBMDOS.COM COMMAND.COM SHEAU-YN.LIN Bad command or file name