Karolmarks Virus

 Virus Name:  Karolmarks 
 Aliases:     Karolmarks.1000 
 V Status:    New 
 Discovered:  July, 1995 
 Symptoms:    .EXE file growth; 
              decrease in total system & available free memory 
 Origin:      Unknown 
 Eff Length:  1,000 Bytes 
 Type Code:   PRtE - Parasitic Resident .EXE Infector 
 Detection Method: VAlert, AVTK, NAV, NAVDX, IBMAV, ViruScan, 
                   F-Prot, ChAV, 
                   AVTK/N, NAV/N, IBMAV/N, NShld, Innoc 4.0+ 
 Removal Instructions:  Delete infected files 
 General Comments: 
       The Karolmarks virus was received in July, 1995.  Its origin or 
       point of isolation is unknown.  Karolmarks is a memory resident 
       infector of .EXE files. 
       When the first Karolmarks infected program is executed, this virus 
       will install itself memory resident at the top of system memory 
       but below the 640K DOS boundary, moving interrupt 12's return.  Total 
       system and available free memory, as indicated by the DOS CHKDSK 
       program from DOS 5.0, will have decreased by 1,600 bytes.  Interrupt 
       21 will be hooked by the virus in memory. 
       Once the Karolmarks virus is memory resident, it will infect .EXE 
       files when they are executed.  Infected programs will have a file 
       length increase of 1,000 bytes with the virus being located at the 
       the end of the file.  The program's date and time in the DOS disk 
       directory listing will not be altered.  The following text string 
       is visible within the viral code: 
           "KaRoLmArKs V2.3" 
       It is unknown what the Karolmarks virus may do besides replicate. 

Show viruses from discovered during that infect .

Main Page