Virus Name: Unk
V Status: Rare
Discovered: March, 1992
Symptoms: .COM & .EXE growth; decrease in total system and available
free memory; file date/times corrupted
Eff Length: 1,015 Bytes
Type Code: PRhAK - Parasitic Resident .COM & .EXE Infector
Detection Method: ViruScan, AVTK, Sweep, IBMAV, ChAV,
NAV, F-Prot, NAVDX, VAlert, PCScan,
NShld, Sweep/N, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N,
Removal Instructions: Delete infected Files
The Unk virus was received in April, 1992. Its origin and point
of isolation are unknown. Unk is a memory resident infector of
.COM and .EXE programs, including COMMAND.COM.
When the first Unk infected program is executed, the Unk virus
will install itself memory resident at the top of system memory
but below the 640K DOS boundary. Total system and available
free memory, as indicated by the DOS CHKDSK program, will have
decreased by 3,008 bytes. Interrupt 21 will be hooked.
Once the Unk virus is memory resident, it will infect .COM and
.EXE programs when they are executed or opened for any reason.
The virus hides the file length increase on infected files, so
it is not noticeable to the system user.
Programs infected with the Unk virus will have a file length
increase of 1,015 bytes with the virus being located at the
end of the infected file. This virus will occassionally reinfect
previously infected programs, adding an additional 1,015 bytes.
The file's date and time in the DOS disk directory may appear
to be corrupted. One text string can be found within the viral
code in Unk infected programs:
"(c) 1991 Szegedi & Farmosi Kiss."
It is unknown what Unk does besides replicate.