Kiwi-550 Virus


 Virus Name:  Kiwi-550 
 Aliases:     Kiwi 
 V Status:    Rare 
 Discovered:  February, 1993 
 Symptoms:    .EXE file growth; decrease in total system and available 
              free memory 
 Origin:      USSR 
 Eff Length:  550 - 566 Bytes 
 Type Code:   PRhE - Parasitic Resident .EXE Infector 
 Detection Method:  Sweep, AVTK, F-Prot, ViruScan, IBMAV, 
                    NAV, NAVDX, VAlert, PCScan, ChAV, 
                    Sweep/N, NShld, NProt, AVTK/N, NAV/N, IBMAV/N, Innoc, 
                    LProt 
 Removal Instructions:  Delete infected files 
 
 General Comments: 
       The Kiwi-550, or Kiwi, virus was submitted in February, 1993, and 
       is originally from the USSR.  Kiwi-550 is a memory resident infector 
       of .EXE programs. 
 
       When the first Kiwi-550 infected program is executed, the Kiwi-550 
       virus will install itself memory resident at the top of system 
       memory but below the 640K DOS boundary, hooking interrupt 21.  Total 
       system and available free memory, as indicated by the DOS CHKDSK 
       program, will have decreased by 608 bytes.  Interrupt 12's return 
       will not have been moved. 
 
       Once the Kiwi-550 virus is memory resident, it will infect .EXE 
       programs when they are executed.  Infected programs will have a 
       file length increase of 550 to 566 bytes with the virus being 
       located at the end of the file.  The program's date and time in the 
       DOS disk directory listing will not be altered.  The following text 
       string can be found within the viral code in all Kiwi-550 infected 
       programs: 
 
               "I'm KIWI-586.(C) Vegetable-Soft,1992.DOS AIDSTESTP" 
 
       It is unknown what Kiwi-550 may do besides replicate. 

Show viruses from discovered during that infect .

Main Page