Kiwi-550 Virus

Virus Name: Kiwi-550 Aliases: Kiwi V Status: Rare Discovered: February, 1993 Symptoms: .EXE file growth; decrease in total system and available free memory Origin: USSR Eff Length: 550 - 566 Bytes Type Code: PRhE - Parasitic Resident .EXE Infector Detection Method: Sweep, AVTK, F-Prot, ViruScan, IBMAV, NAV, NAVDX, VAlert, PCScan, ChAV, Sweep/N, NShld, NProt, AVTK/N, NAV/N, IBMAV/N, Innoc, LProt Removal Instructions: Delete infected files General Comments: The Kiwi-550, or Kiwi, virus was submitted in February, 1993, and is originally from the USSR. Kiwi-550 is a memory resident infector of .EXE programs. When the first Kiwi-550 infected program is executed, the Kiwi-550 virus will install itself memory resident at the top of system memory but below the 640K DOS boundary, hooking interrupt 21. Total system and available free memory, as indicated by the DOS CHKDSK program, will have decreased by 608 bytes. Interrupt 12's return will not have been moved. Once the Kiwi-550 virus is memory resident, it will infect .EXE programs when they are executed. Infected programs will have a file length increase of 550 to 566 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory listing will not be altered. The following text string can be found within the viral code in all Kiwi-550 infected programs: "I'm KIWI-586.(C) Vegetable-Soft,1992.DOS AIDSTESTP" It is unknown what Kiwi-550 may do besides replicate.