Kobrin Virus


 Virus Name:  Kobrin 
 Aliases:     Kobrin.489 
 V Status:    New 
 Discovered:  January, 1996 
 Symptoms:    .COM file growth; file date/time seconds = "60" 
 Origin:      Unknown 
 Eff Length:  489 Bytes 
 Type Code:   PNCK - Parasitic Non-Resident .COM Infector 
 Detection Method:  F-Prot, AVTK, IBMAV, ViruScan, NAV, NAVDX, PCScan, 
                    ChAV, 
                    AVTK/N, IBMAV/N, NAV/N, NShld, Innoc 
 Removal Instructions:  Delete infected files 
 
 General Comments: 
       The Kobrin or Kobrin.489 virus was received in January, 1996.  Its 
       origin or point of isolation is unknown.  Kobrin is a non-resident, 
       direct action infector of .COM files, including COMMAND.COM.  It 
       does not infect very small .COM files. 
 
       When a program infected with the Kobrin virus is executed, this virus 
       will infect all of the .COM files, other than very small ones, 
       located in the current directory.  Infected program s will have a 
       file length increase of 489 bytes with the virus being located at 
       the beginning of the file.  The program's date and time in the DOS 
       disk directory listing will not appear to be altered, though the 
       seconds field will have been set to "60".  The following text 
       strings are visible within the viral code: 
 
           "*.COM" 
           "BrPI-Kobrin" 
           "Andy said:Zarin is dangerous!" 
 
       Known variant(s) of Kobrin are: 
       Kobrin.491: Also received in January, 1996, this is a 491 byte 
           variant of the Kobrin virus described above.  It infects in the 
           same manner, and also contains the same text strings. 
           Origin:  Unknown  January, 1996. 

Show viruses from discovered during that infect .

Main Page