This is a benign memory resident parasitic polymorphic and stealth virus. Being executed it checks DOS version and installs itself as memory resident under DOS 5.0 or above. If there is free block of upper memory, this virus copies itself into UMB. This virus infects files on FindFirst/FindNext DOS calls. On opening an infected file the virus disinfects it.
The virus hooks INT 21h and writes itself to the end of EXE files (except SCAN.EXE). Depending on the system timer it displays the message:
Overkill IV Virus - By MTZ - From Italy -
(Cazzo! Anche oggi un altro 2 di picche, ma si puo' andare avanti cosi' ?)
