Virus Name: K-4C
V Status: Rare
Discovered: June, 1993
Symptoms: .COM file growth
Origin: Sweden or The Netherlands
Eff Length: 737 Bytes
Type Code: PRfCK - Parasitic Resident .COM Infector
Detection Method: F-Prot, ViruScan, IBMAV, Sweep, AVTK, NAV,
NAVDX, VAlert, PCScan, ChAV,
NShld, Sweep/N, NProt, AVTK/N, IBMAV/N, Innoc, NAV/N,
Removal Instructions: Delete infected files
The K-4C virus was submitted in June, 1993, and is from either
Sweden or The Netherlands. K-4C is a memory resident virus, though
it infects via direct action. The memory resident portion of the
virus contains some code to make it resistant to the use of debuggers
to analyse the virus.
When the first K-4C virus infected program is executed, the K-4C
virus will install some code in available free memory, hooking
interrupt 03. This code is not used for the virus to replicate, but
rather to thwart analysing the virus. The virus will then infect up
to five .COM files in the current directory. Later, when the user
executes another K-4C infected program, the code is not reinstalled
in memory, but up to five more .COM programs are infected. The virus
will not infect more than sixteen files in a given directory.
Programs infected with the K-4C virus will have a file length
increase of 737 bytes with the virus being located at the end of
the file. The program's date and time will not be altered. The
following text strings are encrypted within the K-4C virus:
"K-4C VIRUS by K”hntark*.COM"
K-4C is a later version of the K-4B virus.
See: K-4B Kohntark