Virus Name: Kali-4
V Status: Rare
Discovered: August, 1994
Symptoms: .COM & .EXE growth; message displayed;
file date/time seconds = "58"
Origin: Sweden or The Netherlands
Eff Length: 641 Bytes
Type Code: PNAK - Parasitic Resident .COM & .EXE Infector
Detection Method: IBMAV, AVTK, ViruScan, F-Prot, NAV, NAVDX,
IBMAV/N, AVTK/N, NShld, NProt, NAV/N, Innoc 4.0+
Removal Instructions: Delete infected files
The Kali-4 virus was received in August, 1994. It appears to be from
either Sweden or The Netherlands. Kali-4 is a non-resident, direct
action infector of .COM and .EXE programs, including COMMAND.COM.
When a program infected with the Kali-4 virus is executed, this
virus will infect all of the .COM and .EXE programs located in the
current directory. Infected programs will increase in size by 641
bytes with the virus being located at the end of the file. The
program's date and time in the DOS disk directory listing will not
appear to be altered, though the seconds field will have been set to
"58". The following text string is visible within the viral code in
all Kali-4 infected programs:
"KaLi-4 / K”hntark"
The following additional text strings are encrypted within the viral
code, and are thus not visible within infected files:
The last text string above may be displayed by the virus when an
infected program is executed.