This is an overwriting HTML virus written by the same author. This virus, as
well as the first one, looks for all HTML files in the current and parent
directories and infects them. While infecting, the virus overwrites the
contents of the file.
The virus body has the text comment “HTML.Offline v0.1” as well as
reference to the virus author Web page.
This is a companion version of this virus family. It scans the current
and parent directories for HTML files, renames them with an HTML extension and
copies its body with the original name of the infected file. When the infection
routine exits, the virus returns the control to the original HTML code by
replacing the name of the active file.
Depending on the system’s random counter, the virus displays the following MessageBox: