Kali-4 Virus

Virus Name: Kali-4 Aliases: V Status: Rare Discovered: August, 1994 Symptoms: .COM & .EXE growth; message displayed; file date/time seconds = "58" Origin: Sweden or The Netherlands Eff Length: 641 Bytes Type Code: PNAK - Parasitic Resident .COM & .EXE Infector Detection Method: IBMAV, AVTK, ViruScan, F-Prot, NAV, NAVDX, PCScan, ChAV, IBMAV/N, AVTK/N, NShld, NProt, NAV/N, Innoc 4.0+ Removal Instructions: Delete infected files General Comments: The Kali-4 virus was received in August, 1994. It appears to be from either Sweden or The Netherlands. Kali-4 is a non-resident, direct action infector of .COM and .EXE programs, including COMMAND.COM. When a program infected with the Kali-4 virus is executed, this virus will infect all of the .COM and .EXE programs located in the current directory. Infected programs will increase in size by 641 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory listing will not appear to be altered, though the seconds field will have been set to "58". The following text string is visible within the viral code in all Kali-4 infected programs: "KaLi-4 / K”hntark" The following additional text strings are encrypted within the viral code, and are thus not visible within infected files: "*.COM *.EXE" "SCAN.EXE EXE" The last text string above may be displayed by the virus when an infected program is executed.