Elvira has no destructive effects; it only carries out the following actions:

• It infects files with an EXE or COM extension.
• The infected files increase their size in 4250 bytes.
• It displays messages on screen.

Elvira modifies the following files:

• WIN.COM, in the Windows directory. By doing this, it ensures that it will be activated every time the affected computer is started up.

Elvira does not use any specific means to spread. It can reach computers through the normal means used by viruses: e-mail messages with infected attachments, computer networks, CD-ROMs, Internet downloads, FTP, floppy disks, etc.

Other interesting characteristics of Elvira are:

• The file that carries out the infection is 4250 bytes in size.
• Elvira encrypts itself using the system hour, thus it is possible to find up to 366 variants of this virus.
• If a file beginning with PK, AR, RA, LH or BA is run, the routine which the virus uses to carry out its stealth process will get deactivated.
• It will not infect files which begin with TB, VI, AV, NA, VS, FI, F-, FV, IV, DR, SC, GU, CO. The COMMAND.COM file is one of them.