Cadkill Virus

Virus Name: Cadkill Aliases: Milous V Status: Rare Discovery: July, 1991 Symptoms: .COM & .EXE growth; decrease in total system and available memory Origin: Unknown Eff Length: 1,163 Bytes Type Code: PRhAK - Parasitic Resident .COM & .EXE Infector Detection Method: ViruScan, AVTK, Sweep, F-Prot, IBMAV, NAV, NAVDX, VAlert, PCScan, ChAV, NShld, Sweep/N, Innoc, AVTK/N, LProt, IBMAV/N, NAV/N Removal Instructions: Delete infected files General Comments: The Cadkill virus was received in July, 1991. Its origin is unknown. Cadkill is a memory resident generic infector of .COM and .EXE files, including COMMAND.COM. The first time a program infected with Cadkill is executed, the Cadkill virus will install itself memory resident at the top of system memory but below the 640K DOS boundary. Total system and available free memory, as measured by the DOS CHKDSK program, will decrease by 2,048 bytes. Interrupts 1C, 21, and 24 will be hooked by the virus. After Cadkill is memory resident, it will infect .COM and .EXE files when they are executed. If COMMAND.COM is executed, it will become infected. Infected files will increase in size by 1,163 bytes. The virus will be located at the end of the infected file. It is unknown what Cadkill does besides replicate.