Windows 2000, Windows XP, Windows Server 2003
This is a type of polymorphic DOS virus that infects COM and EXE files. It uses a complex polymorphic engine to decrypt its code. This virus can be memory or non-memory resident. Non-memory resident variants search for and then infect COM and EXE files in an infected system. Memory-resident variants hook the DOS function interrupt, INT 21h and infect files that are opened or executed. In both variants, the virus appends its encrypted code at the end of infected files and modifies the header to point to its code. The virus also inserts garbage data within its codes. It does not contain any destructive payload.
For Windows XP and Windows Server 2003 users, before doing any scans, please make sure you disable System Restore to allow full scanning of your computer.
Restore your system’s Master Boot Record (MBR)
To restore your system's Master Boot Record (MBR):
Scan your computer with your Trend Micro product to clean files detected as ACG.Ax. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.