Kobrin Virus

Virus Name: Kobrin Aliases: Kobrin.489 V Status: New Discovered: January, 1996 Symptoms: .COM file growth; file date/time seconds = "60" Origin: Unknown Eff Length: 489 Bytes Type Code: PNCK - Parasitic Non-Resident .COM Infector Detection Method: F-Prot, AVTK, IBMAV, ViruScan, NAV, NAVDX, PCScan, ChAV, AVTK/N, IBMAV/N, NAV/N, NShld, Innoc Removal Instructions: Delete infected files General Comments: The Kobrin or Kobrin.489 virus was received in January, 1996. Its origin or point of isolation is unknown. Kobrin is a non-resident, direct action infector of .COM files, including COMMAND.COM. It does not infect very small .COM files. When a program infected with the Kobrin virus is executed, this virus will infect all of the .COM files, other than very small ones, located in the current directory. Infected program s will have a file length increase of 489 bytes with the virus being located at the beginning of the file. The program's date and time in the DOS disk directory listing will not appear to be altered, though the seconds field will have been set to "60". The following text strings are visible within the viral code: "*.COM" "BrPI-Kobrin" "Andy said:Zarin is dangerous!" Known variant(s) of Kobrin are: Kobrin.491: Also received in January, 1996, this is a 491 byte variant of the Kobrin virus described above. It infects in the same manner, and also contains the same text strings. Origin: Unknown January, 1996.