W32/Metrion-B will infect several EXE files at a time. When an infected file is run two processes are created one for the virus and one for the host file. The host will behave as expected and the virus will only start infecting when the host program has terminated. The viral process will terminate when infection has completed.
BAT files are overwritten with a two line batch script that is designed to run the virus. Since this action may well affect batch files that are executed when Windows starts up, the virus is likely to be run at this time.
CPP files are overwritten with a few lines of C++ code that will print the output "Tagged by Metrion Cascade II" when compiled.
VBS files are overwritten with a single line of VBScript that displays the same output as the compiled C++ code would.
HTM files are overwritten with several lines of HTML that will display a page containing the text "Metrion Cascade II -icarus".