It is a dangerous nonmemory resident overwriting virus. It searches for .ASM files, renames the file with BAK file name extension, then overwrites the .ASM file with the hexadecimal code of the virus that is converted to ASM format. The result of infection looks as follows:
.MODEL TINY
.CODE
ORG 256
a:
DB 0FCh
DB 0B4h
all
< the hexadecimal code of the virus >
...
ENDS
END a
When that file is assembled, the result is a copy of the virus.
The virus contains the internal text strings:
0123456789ABCDEF.MODEL TINY
.CODE
ORG 256
a:
ENDS
END a
h
DB
*.asm bak 0
