There are 5 variants:
- Virus.DOS.Vanitas.2040 (plus B)
- Virus.DOS.Vanitas.3712 (A, B and C)
When the virus is in memory, it hooks INT 21h to infect any EXE executable file that are accessed by writing itself to the end the file. The virus does not infect files having the filename:
EMM386 SCAN F-PROT
While installing memory resident the virus also infects the C:\WINDOWS\COMMAND.COM and C:\COMMAND.COM, if available, as they are also in MZ EXE format in DOS version 7.
The virus has a bug and may halt the system while installing memory resident, so debugging is required in order to let the virus to install itself into memory.
On March 27 the virus manifests itself by a video effect.
The virus contains the text strings:
VANITAS++ v2.0 GR(c)97 by ANAX. [E-75] goes to Hell. Have a nice death...