Karolmarks Virus

Virus Name: Karolmarks Aliases: Karolmarks.1000 V Status: New Discovered: July, 1995 Symptoms: .EXE file growth; decrease in total system & available free memory Origin: Unknown Eff Length: 1,000 Bytes Type Code: PRtE - Parasitic Resident .EXE Infector Detection Method: VAlert, AVTK, NAV, NAVDX, IBMAV, ViruScan, F-Prot, ChAV, AVTK/N, NAV/N, IBMAV/N, NShld, Innoc 4.0+ Removal Instructions: Delete infected files General Comments: The Karolmarks virus was received in July, 1995. Its origin or point of isolation is unknown. Karolmarks is a memory resident infector of .EXE files. When the first Karolmarks infected program is executed, this virus will install itself memory resident at the top of system memory but below the 640K DOS boundary, moving interrupt 12's return. Total system and available free memory, as indicated by the DOS CHKDSK program from DOS 5.0, will have decreased by 1,600 bytes. Interrupt 21 will be hooked by the virus in memory. Once the Karolmarks virus is memory resident, it will infect .EXE files when they are executed. Infected programs will have a file length increase of 1,000 bytes with the virus being located at the the end of the file. The program's date and time in the DOS disk directory listing will not be altered. The following text string is visible within the viral code: "KaRoLmArKs V2.3" It is unknown what the Karolmarks virus may do besides replicate.