Kali-4 Virus


 Virus Name:  Kali-4 
 Aliases: 
 V Status:    Rare 
 Discovered:  August, 1994 
 Symptoms:    .COM & .EXE growth; message displayed; 
              file date/time seconds = "58" 
 Origin:      Sweden or The Netherlands 
 Eff Length:  641 Bytes 
 Type Code:   PNAK - Parasitic Resident .COM & .EXE Infector 
 Detection Method:  IBMAV, AVTK, ViruScan, F-Prot, NAV, NAVDX, 
                    PCScan, ChAV, 
                    IBMAV/N, AVTK/N, NShld, NProt, NAV/N, Innoc 4.0+ 
 Removal Instructions:  Delete infected files 
 
 General Comments: 
       The Kali-4 virus was received in August, 1994.  It appears to be from 
       either Sweden or The Netherlands.  Kali-4 is a non-resident, direct 
       action infector of .COM and .EXE programs, including COMMAND.COM. 
 
       When a program infected with the Kali-4 virus is executed, this 
       virus will infect all of the .COM and .EXE programs located in the 
       current directory.  Infected programs will increase in size by 641 
       bytes with the virus being located at the end of the file.  The 
       program's date and time in the DOS disk directory listing will not 
       appear to be altered, though the seconds field will have been set to 
       "58".  The following text string is visible within the viral code in 
       all Kali-4 infected programs: 
 
               "KaLi-4 / K”hntark" 
 
       The following additional text strings are encrypted within the viral 
       code, and are thus not visible within infected files: 
 
               "*.COM *.EXE" 
               "SCAN.EXE EXE" 
 
       The last text string above may be displayed by the virus when an 
       infected program is executed. 

Show viruses from discovered during that infect .

Main Page