Processing then tests the memory allocation fields within the header, and also true file size, to ensure that the file has no additional code. Next, as non-EXE files, random garbage bytes are written to make the size a multiple of 16. Extra processing is then completed to modify the EXE header segment and offset fields to ensure that the virus is processed first. A childish trick is employed to make the virus code 'appear' to be in the stack segment of the host program. This might confuse some simple debuggers and disassemblers, but is merely an empty gesture to an experienced researcher.
Processing then returns to the host program.
The primary check for the trigger routine has already been mentioned in the installation section. The generation counter is set such that it only increments each time the virus code is installed into memory. Thus, if the counter value is five, after installation it will become six. This will be the value in every infected copy generated during that session. There is little likelihood of the number increasing by more than two or three during the life of the virus on a specific machine.