SNA Virus

 Virus Name:  SNA 
 Aliases:     Kid, SNA.393 
 V Status:    New 
 Discovered:  January, 1995 
 Symptoms:    .COM file growth; file date/time changes; 
              Read-Only attribute set on .COM files 
 Origin:      Unknown 
 Eff Length:  393 Bytes 
 Type Code:   PNCK - Parasitic Non-Resident .COM Infector 
 Detection Method:  F-Prot, AVTK, IBMAV, Sweep, ViruScan, NAV, 
                    NAVDX, VAlert, PCScan, ChAV, 
                    AVTK/N, IBMAV/N, Sweep/N, NProt, NShld, NAV/N, Innoc 4.0+ 
 Removal Instructions:  Delete infected files 
 General Comments: 
       The SNA virus was received in January, 1995.  Its origin or point 
       of isolation is unknown.  SNA is a non-resident, direct action 
       infector of .COM files, including COMMAND.COM.  It is unknown what 
       it may do besides replicate. 
       When the first SNA infected program is executed, this virus will 
       infect one .COM file located in the current directory.  If COMMAND.COM 
       is located in this directory, it may become infected by the virus. 
       Files infected with the SNA virus will have a file length increase 
       of 393 bytes with the virus being located at the end of the file. 
       The file's date and time in the DOS disk directory listing will have 
       been updated to the current system date and time when infection 
       occurred.  The Read-Only attribute will also be set on all infected 
       files.  The following text strings can be found within the viral 
       code in all SNA infected programs: 
               "SNA*.* \ *.com" 
       Additionally, the text string "SNA" can be found starting in the 
       fourth byte of all infected files. 

Show viruses from discovered during that infect .

Main Page