SNA Virus

Virus Name: SNA Aliases: Kid, SNA.393 V Status: New Discovered: January, 1995 Symptoms: .COM file growth; file date/time changes; Read-Only attribute set on .COM files Origin: Unknown Eff Length: 393 Bytes Type Code: PNCK - Parasitic Non-Resident .COM Infector Detection Method: F-Prot, AVTK, IBMAV, Sweep, ViruScan, NAV, NAVDX, VAlert, PCScan, ChAV, AVTK/N, IBMAV/N, Sweep/N, NProt, NShld, NAV/N, Innoc 4.0+ Removal Instructions: Delete infected files General Comments: The SNA virus was received in January, 1995. Its origin or point of isolation is unknown. SNA is a non-resident, direct action infector of .COM files, including COMMAND.COM. It is unknown what it may do besides replicate. When the first SNA infected program is executed, this virus will infect one .COM file located in the current directory. If COMMAND.COM is located in this directory, it may become infected by the virus. Files infected with the SNA virus will have a file length increase of 393 bytes with the virus being located at the end of the file. The file's date and time in the DOS disk directory listing will have been updated to the current system date and time when infection occurred. The Read-Only attribute will also be set on all infected files. The following text strings can be found within the viral code in all SNA infected programs: "(c)1992littleKid!" "SNA*.* \ *.com" Additionally, the text string "SNA" can be found starting in the fourth byte of all infected files.