The infection process of EMS starts with the executing an infected file. The JMP passes control to the virus code, which test system memory for an active copy of itself. The first step is to determine whether the EMS driver is loaded. If no driver is found, then control is returned to host file and system memory is not infected. If an EMS driver is found, then the virus obtains the number of unallocated pages.
Control is passed to the host file when no free pages are found.
Otherwise, the virus finds the EMS frame segment address and stores it. Then, it allocates one EMS page and makes it available for its use. Then it copies itself into that frame and unmaps the page. Now, the virus is stored in EMS memory. Finally, control is returned to the host program.