When the virus is run, it randomly pick one EXE file, uses its name to generate a DOS executable by dropping itself into this new file. As on MS-DOS, for any two executables sharing the same filename, the DOS executable always run first, followed by the EXE one.
The file dropped by the virus would always have a size of 8,304 bytes. If there is already one drop program created by the virus in the same directory, further executions of the virus will generate nothing unless that file has been moved.
The user may run the host EXE program as usual, meanwhile the virus is also being run.
This virus does not stay memory resident after execution.
The virus activates by random. It draws an ASCII plane moving on the screen, and then it would drop off an ASCII man with parachute.
The user must wait until the ASCII animation ends.
The virus contains the internal text strings:
EXE /C COMSPEC *.exe
- Description of HLLC on F-Secure Labs