KLF-356 Virus

 Virus Name:  KLF-356 
 V Status:    Rare 
 Discovered:  December, 1992 
 Symptoms:    .COM file growth 
 Origin:      USSR 
 Eff Length:  356 Bytes 
 Type Code:   PRaCK - Parasitic Resident .COM Infector 
 Detection Method:  AVTK, IBMAV, Sweep, F-Prot, ViruScan, 
                    NAV, NAVDX, VAlert, PCScan, ChAV, 
                    Sweep/N, NShld, Innoc, NProt, AVTK/N, LProt, NAV/N, 
 Removal Instructions:  Delete infected files 
 General Comments: 
       The KLF-356 virus was submitted in December, 1992 and is originally 
       from the USSR.  KLF-356 is a memory resident infector of .COM 
       programs, including COMMAND.COM. 
       When the first KLF-356 infected program is executed, the KLF-356 
       virus will install itself memory resident in a "hole" in allocated 
       system memory at approximately 0000:025E.  Interrupt 21 will be 
       hooked by the virus.  Total system and available free memory, as 
       indicated by the DOS CHKDSK program, will not be altered. 
       Once the KLF-356 virus is memory resident, it will infect .COM 
       programs, including COMMAND.COM, when they are executed.  Infected 
       programs will have a file length increase of 356 bytes with the 
       virus being located at the end of the file.  The program's date 
       and time in the DOS disk directory listing will not be altered. 
       The following text strings are visible within the KLF-356 viral 
               "The KLF3" 
       The first of these text strings occurs very near the beginning of 
       the infected file, and the last text string occurs in the viral 
       code at the end of the file. 
       KLF-356 doesn't appear to do anything besides replicate. 

Show viruses from discovered during that infect .

Main Page