There are 3 variants:
When the virus is loaded into memory, it hooks onto INT 21h and writes itself to the end of .EXE files that are executed. When a program is terminated, it displays one of the messages:
Kill an evil satanic ANTI-VIRAL product for Jesus today! Stop Disinfectants NOW! Ain't aLife A Beautiful Choice? And God Said, "Let There Be Life!", and there was..... Save the Viruses! They're People Too!!!! PRO-aLIFE and PROUD! STOP THE VIRUS KILLERS! HALT THE AV! STORM THE COMPU-CLINICS! DON'T LET THEM KILL THE VIRUSES!!! Operation Rescue-II, Save the HELPLESS UNBORN Viruses!!!
|Variant||Memory usage in bytes|
When the anti-virus programs are executed:
F-PROT.EXE TBSCAN.EXE TBAV.EXE TBCLEAN.EXE SCAN.EXE CLEAN.EXE VIRSTOP.EXE MSAV.EXE VSAFE.EXE CPAV.EXE FSP.EXE VDEFEND.EXE
The virus overwrites them with the trojan program that displays being executed:
Eddie Lives, Somewhere in time! ____________ 1704 Jerusalem Casino :( ;( =( Smeg off! _____ ____ \ Frodo Lives! APRIL FOOLS! Get a late pass! Datacrime _______________ Brain Void-Poem Your PC is now STONED! __ OO _____ O _ Copy me, I want to travel! 1,000,000,000 Viruses DIED Today! And yesterday, and more will die tomorrow! _/\_STOP THE KILLING!_/\_ Look What You're Doing To Them! Below is an aborted virus... Support PRO-aLIFE Activism! This program has been TERMINATED by the Virus Survival Underground Movement. It had long stood as a horrible BABY VIRUS KILLER, and had to be removed. Life, What a Beautiful Choice (tm). --==___[OPERATION RESCUE II - SAVING THE BABY VIRUSES!]___==-- Thank you for choosing life over destruction. Have a Nice Day (tm).
Virus.DOS.JTTP is a modification of Pro-Alife.3423.b, while it contains different codes of the payload.