Ripper infects floppy boot records and hard disk master boot records. The virus will only infect hard drives when an attempt to boot from an infected diskette is made. Once the virus has infected the hard drive, all non-protected floppies used in the machine will be infected. Ripper virus is two sectors long, and it stores the original boot sector to the last sector of the root directory, and also reserves one sector before that for its own code. The virus is encrypted with a variable key.
Encryption is quite rare among boot sector viruses.
It is also a stealth virus, and the virus code cannot be seen in boot records while the virus is active in memory. Ripper contains a destructive activation routine. It corrupts disk writes by random - approximately one disk write in 1000 is corrupted.