It's a not dangerous memory resident boot virus. On loading from infected floppy it writes itself into MBR of hard drive and unused sectors before first boot sector. On loading from infected hard drive it copies its INT 13h handler's code (128 bytes) into interrupt vectors table, hooks INT 13h and writes itself into boot sectors of floppy disks are accessed. It does not keep its body in memory, on infection of floppy disks it copies the body from infected hard drive to floppy disk sectors (the last sectors of the root directory ones). Depending on system timer it displays the message:
XIV L.O. Wroclaw
Najlepszy polski program antywirusowy
MkS_Vir kupisz w firmie:
APEXIM Sp. z o.o.
ul. Dzielna 74/76
01-029 Warszawa
tel. 38-92-82
It contains the additional text strings:
Pozdrawiam wszystkich uczni¢w Czternastki!
Autor
