How Chronic works
Each time the Chronic payload runs, the first 1020 bytes of the following files are modified and the text "Karachi_y2k7" is appended to these same files:
C:\WINDOWS\SOL.EXE
C:\WINDOWS\MSHEARTS.EXE
C:\WINDOWS\FREECELL.EXE
The modifications will corrupt a file such that it will no longer work.
According to the anti-virus company Sophos, if the current system day can be divided exactly by 2, Chronic will then print between 1 and 9 copies of the current Word document.
If the current system day can be divided exactly by 3, then the first 1020 bytes of the following files are modified and the text "Karachi_y2k7" appended:
C:\WINDOWS\ROUTE.EXE
C:\WINDOWS\PING.EXE
C:\WINDOWS\SYSTEM\NETOS.DLL
C:\WINDOWS\SYSTEM\NETDI.DLL
C:\WINDOWS\SYSTEM\NETBIOS.DLL
C:\WINDOWS\SYSTEM\NETAPI.DLL
C:\WINDOWS\SYSTEM\NETAPI32.DLL
However, Chronic, can be much more sinister. If the current system day can also be divided exactly by 4, the virus will modify C:\WINDOWS\WIN.COM to contain the Trojan Troj/KillCMOS-E. This Trojan will attempt to overwrite the CMOS settings with random data and will be run the next time Windows is restarted.
If the current system day can be divided by 5 (i.e., the 5th, the 10th, the 15th), Chronic will lock the file sharing options of the current document with a password. That value may be "1297307460."
If the current system day can also be divided exactly by 6, the virus will copy C:\WINDOWS\WIN.COM to WIN.ORG and then create a new C:\WINDOWS\WIN.COM with the Trojan Troj/KillCMOS-E.
If the current system day can be divided exactly by 3 and by 6, then the first 1020 bytes of the following files are modified and the text "Karachi_y2k7" appended:
C:\WINDOWS\SYSTEM\NETCPL.CPL
C:\WINDOWS\SYSTEM\INETCPL.CPL
C:\WINDOWS\SYSTEM\MODEM.CPL
C:\WINDOWS\SYSTEM\URL.DLL
C:\WINDOWS\SYSTEM\SENDMAIL.DLL
C:\WINDOWS\SYSTEM\MAPI32.DLL
C:\WINDOWS\SYSTEM\INETCOMM.DLL
C:\WINDOWS\SYSTEM\INETCFG.DLL
C:\WINDOWS\SYSTEM\INETAB32.DLL
C:\WINDOWS\SYSTEM\INET16.DLL
If the current system day can be divided exactly by 3 and by 6 and by 9, then the following files are also affected:
C:\WINDOWS\SYSTEM\LPT.VXD
C:\WINDOWS\SYSTEM\SPOOL32.EXE
C:\WINDOWS\SYSTEM\MSPRINT.DLL
C:\WINDOWS\SYSTEM\MSPRINT2.DLL
