If infecting a floppy diskette, Ripper copies both its virus code and the original boot sector to the last two sectors on the diskette. If infecting a hard drive, Ripper copies itself to cylinder 0, head 0, sector 8 and then copies the original partition table to cylinder 0, head 0, sector 9. When the virus is accessed, it returns an image of the original boot sector to avoid detection. Information on Ripper's payload varies. EXEbug infects boot sectors on both floppy diskettes and hard drives.
Infection occurs only when a computer is booted from an infected floppy diskette.
To avoid detection when accessed, EXEbug returns an image of the original boot sector. EXEbug also redirects antivirus software to the original boot sector to avoid detection. In addition, if you use the COPY or LINK command to write executable files to the computer's hard drive, EXEbug can infect these executable files. If EXEbug infects an executable file by successfully overwriting it, the infected EXE file becomes a Trojan horse. When the infected file is executed, it deletes all files in the directory in which it is run.