The virus installs itself by manipulating the Memory Control Blocks. DOS calls are used to install the resident INT 21h handler. Files with an EXE header are excluded by testing for 'MZ' as the first word of the file. Files larger than 62.5 KB are also ignored. If a victim file start with a jump to a location of 1241 bytes before the end of the file, virus concludes that the file is already installed.
File attribute is cleared and restored afterwards.
Infection is done by appending the virus. Virus checks the system data. Then the message is printed on the screen. When the message is displayed for the first time, data on disks is lost already. A maximum of 4 attempts are made at each disk operation.