Virus Name: Cadkill
V Status: Rare
Discovery: July, 1991
Symptoms: .COM & .EXE growth; decrease in total system and available
Eff Length: 1,163 Bytes
Type Code: PRhAK - Parasitic Resident .COM & .EXE Infector
Detection Method: ViruScan, AVTK, Sweep, F-Prot, IBMAV, NAV, NAVDX,
VAlert, PCScan, ChAV,
NShld, Sweep/N, Innoc, AVTK/N, LProt, IBMAV/N, NAV/N
Removal Instructions: Delete infected files
The Cadkill virus was received in July, 1991. Its origin is
unknown. Cadkill is a memory resident generic infector of .COM
and .EXE files, including COMMAND.COM.
The first time a program infected with Cadkill is executed, the
Cadkill virus will install itself memory resident at the top of
system memory but below the 640K DOS boundary. Total system and
available free memory, as measured by the DOS CHKDSK program, will
decrease by 2,048 bytes. Interrupts 1C, 21, and 24 will be
hooked by the virus.
After Cadkill is memory resident, it will infect .COM and .EXE files
when they are executed. If COMMAND.COM is executed, it will become
infected. Infected files will increase in size by 1,163 bytes. The
virus will be located at the end of the infected file.
It is unknown what Cadkill does besides replicate.