This virus will manipulate the Master Boot Record of an AT hard disk by using port commands. The virus modifies the MBR data area so that the first partition will point to itself. This will cause the system not to boot if using certain MS-DOS versions that contain a bug and are unable to boot the system correctly.
It has two known variants, which appends either 1,633 or 1,245 bytes to the last section of the PE executables. The PE
headers entrypoint will point to the start of the virus in the last section. The last section characteristic is changed to writeable and the PE header's Reserved1 field will contain two spaces (0x2020).
When the virus is executed, it checks for an active copy of itself in memory by calling VxDcallIFSMgr_Get_Version and passing 0x2020 (Spaces) in the AX register. On return, the AX is 0xDEAD when the virus is active in memory. In such a case, the virus checks the time and calls its payload routine on the 1st of June each year and corrupts the AT hard disk.
When the virus does not detect itself in memory, the virus will allocate memory for itself and hooks the file system to itself. This way it can infect all files that are accessed with the .EXE file name extension.
Since VxD calls are patched on the fly by Windows 9x systems, the virus fixes its copy for those places before it writes itself to the file.

In order to safely remove this virus, boot from a clean system diskette first to clean the virus. AntiVirus will not remove the 0x2020 id from the Reserved1 field of the PE header. As a benefit, this will act as inoculation from the virus since the virus will assume the file is already infected.