This is a dangerous memory resident stealth parasitic virus. It traces INT 13h, 21h, hooks INT 21h and then writes itself to the beginning of COM files and to the middle of EXE files (between the header of EXE file and the module body) when these files are accessed:
COM file EXE file
+-------+ +-------+ +--------+ +--------+
¦ ¦--+ ¦Virus ¦ ¦Header ¦ ¦Header ¦
¦- - - -¦ ¦ +-------¦ +--------¦ +--------¦
¦ ¦ ¦ ¦ ¦ ¦ ¦--+ ¦Virus ¦
¦ ¦ ¦ ¦ ¦ ¦- - - - ¦ ¦ +--------¦
+-------+ ¦ ¦- - - -¦ +--------+ ¦ ¦- - - - ¦
+->¦ ¦ +->¦ ¦
+-------+ +--------+
This virus uses the algorithm of the "Beast" virus: it writes a part of the file being saved to the free sectors of the last cluster of the file, and the file length does not grow.
