It is a harmless(?) memory resident polymorphic parasitic virus. While installing it hooks INT 13h, 21h by patching the handlers: the virus overwrites INT 21h handler's code with INT C2h call and hooks INT C2, then it overwrites INT 13h handler's entry with the "FAR JMP Virus" code. When INT 21h function is executed the virus restores the code of INT 21h handler before return to the original INT 21h handler, on next INT 13h call the virus patches INT 21h handler once more.
The virus writes itself to the end of EXE files that are accessed. The virus contains the code that overwrites the data files with the string:
sono solo stronzate
but that code does not receives the control. The virus also contains the text strings:
ocxtas.cppodroorsmspldakrgbfpsiprj
[For piratesall (C)1993-94 nessuno]
