Virus Name: KLF-356
V Status: Rare
Discovered: December, 1992
Symptoms: .COM file growth
Eff Length: 356 Bytes
Type Code: PRaCK - Parasitic Resident .COM Infector
Detection Method: AVTK, IBMAV, Sweep, F-Prot, ViruScan,
NAV, NAVDX, VAlert, PCScan, ChAV,
Sweep/N, NShld, Innoc, NProt, AVTK/N, LProt, NAV/N,
Removal Instructions: Delete infected files
The KLF-356 virus was submitted in December, 1992 and is originally
from the USSR. KLF-356 is a memory resident infector of .COM
programs, including COMMAND.COM.
When the first KLF-356 infected program is executed, the KLF-356
virus will install itself memory resident in a "hole" in allocated
system memory at approximately 0000:025E. Interrupt 21 will be
hooked by the virus. Total system and available free memory, as
indicated by the DOS CHKDSK program, will not be altered.
Once the KLF-356 virus is memory resident, it will infect .COM
programs, including COMMAND.COM, when they are executed. Infected
programs will have a file length increase of 356 bytes with the
virus being located at the end of the file. The program's date
and time in the DOS disk directory listing will not be altered.
The following text strings are visible within the KLF-356 viral
The first of these text strings occurs very near the beginning of
the infected file, and the last text string occurs in the viral
code at the end of the file.
KLF-356 doesn't appear to do anything besides replicate.