Infection only takes place if more than 3000 bytes are free on the current drive. A dummy critical error handler is installed each time a file is to be infected. The old handler is not restored so crashes are likely some time after running infected files. Date and time are preserved, except the seconds field is set to 62. For instance, the virus is copied to this area for encryption.
Infection is done by appending the virucode to the start of the file.
The text is written to the first 6 sectors of the first 256 cylinders of the current drive, heads 0 and 1. This loops forever unless the INT 13h write disk command returns an error. If such an error occurs the virus exits into the host program as it would if the damage had not been done. This variant is 897 bytes, and infects EXE files, not COM files. Fichv 2.0 An earlier version of the virus.