Virus Name: Kiwi-550
V Status: Rare
Discovered: February, 1993
Symptoms: .EXE file growth; decrease in total system and available
Eff Length: 550 - 566 Bytes
Type Code: PRhE - Parasitic Resident .EXE Infector
Detection Method: Sweep, AVTK, F-Prot, ViruScan, IBMAV,
NAV, NAVDX, VAlert, PCScan, ChAV,
Sweep/N, NShld, NProt, AVTK/N, NAV/N, IBMAV/N, Innoc,
Removal Instructions: Delete infected files
The Kiwi-550, or Kiwi, virus was submitted in February, 1993, and
is originally from the USSR. Kiwi-550 is a memory resident infector
of .EXE programs.
When the first Kiwi-550 infected program is executed, the Kiwi-550
virus will install itself memory resident at the top of system
memory but below the 640K DOS boundary, hooking interrupt 21. Total
system and available free memory, as indicated by the DOS CHKDSK
program, will have decreased by 608 bytes. Interrupt 12's return
will not have been moved.
Once the Kiwi-550 virus is memory resident, it will infect .EXE
programs when they are executed. Infected programs will have a
file length increase of 550 to 566 bytes with the virus being
located at the end of the file. The program's date and time in the
DOS disk directory listing will not be altered. The following text
string can be found within the viral code in all Kiwi-550 infected
"I'm KIWI-586.(C) Vegetable-Soft,1992.DOS AIDSTESTP"
It is unknown what Kiwi-550 may do besides replicate.