Virus Name: SNA
Aliases: Kid, SNA.393
V Status: New
Discovered: January, 1995
Symptoms: .COM file growth; file date/time changes;
Read-Only attribute set on .COM files
Eff Length: 393 Bytes
Type Code: PNCK - Parasitic Non-Resident .COM Infector
Detection Method: F-Prot, AVTK, IBMAV, Sweep, ViruScan, NAV,
NAVDX, VAlert, PCScan, ChAV,
AVTK/N, IBMAV/N, Sweep/N, NProt, NShld, NAV/N, Innoc 4.0+
Removal Instructions: Delete infected files
The SNA virus was received in January, 1995. Its origin or point
of isolation is unknown. SNA is a non-resident, direct action
infector of .COM files, including COMMAND.COM. It is unknown what
it may do besides replicate.
When the first SNA infected program is executed, this virus will
infect one .COM file located in the current directory. If COMMAND.COM
is located in this directory, it may become infected by the virus.
Files infected with the SNA virus will have a file length increase
of 393 bytes with the virus being located at the end of the file.
The file's date and time in the DOS disk directory listing will have
been updated to the current system date and time when infection
occurred. The Read-Only attribute will also be set on all infected
files. The following text strings can be found within the viral
code in all SNA infected programs:
"SNA*.* \ *.com"
Additionally, the text string "SNA" can be found starting in the
fourth byte of all infected files.