There are 5 variants in 3 versions, represented by the following:
When the virus is loaded into memory, it infects C:\COMMAND.COM by instant, followed by hooking INT 8 and 21h to infect any DOS executable that is run. Except Semtex.515 and 686, they do not infect any files, but would decrease the total available system memory by 4K.
For Semtex.686, a system hang would occur when the user runs it while the virus is already in memory.
The following table shows the memory usage of the variants.
|Variant||Memory usage in bytes|
Showing colorful boxes and random characters is the payload of this virus, which is similar to Crash but the characters to be shown by this virus are trended to be more random.
This virus does not hang the system during the payload so the user may still run any tasks, even the random characters are blocking the user's view.
This variant activates immediately. Upon a keypress, it changes the characters on screen.
Semtex.619 and 1000.a
These variants do not activate immediately, but activate on every time when there is no keyboard activity for about 1 minute.
Semtex.686 and 1000.b
Every time the minute of the system time hits 0, these variants activate once.
This family has 5 variants in total:
- Virus.DOS.Semtex.1000 (A and B)
Semtex.619 has been identified as Semtex.1000.b by some antiviruses even the infection sizes are actually different.
Semtex.515 contains the internal text string:
S E M T E X by Dusan Toman, CZECHOSLOVAKIA (7)213-040 or (804)212-23
Semtex.619 contains the internal text strings:
S E M T E X by Dusan Toman, CZECHOSLOVAKIA (7)213-040 or (804)212-23 Hell
Semtex.686 contains the internal text string:
!!! explosive !!! S E M T E X !!! explosive !!! Written by Dusan Toman, CZECHOSLOVAKIA Pyrotechnician Lilo Hedera (7)213-040 or (804)212-23
Semtex.1000.a contains the internal text strings:
S E M T E X by Dusan Toman, CZECHOSLOVAKIA (7)213-040 or (804)212-23 Hell no label v0412
Semtex.1000.b contains the internal text strings:
S E M T E X by Dusan Toman, CZECHOSLOVAKIA *** Have a nice day ***