Virus Name: Kobrin
V Status: New
Discovered: January, 1996
Symptoms: .COM file growth; file date/time seconds = "60"
Eff Length: 489 Bytes
Type Code: PNCK - Parasitic Non-Resident .COM Infector
Detection Method: F-Prot, AVTK, IBMAV, ViruScan, NAV, NAVDX, PCScan,
AVTK/N, IBMAV/N, NAV/N, NShld, Innoc
Removal Instructions: Delete infected files
The Kobrin or Kobrin.489 virus was received in January, 1996. Its
origin or point of isolation is unknown. Kobrin is a non-resident,
direct action infector of .COM files, including COMMAND.COM. It
does not infect very small .COM files.
When a program infected with the Kobrin virus is executed, this virus
will infect all of the .COM files, other than very small ones,
located in the current directory. Infected program s will have a
file length increase of 489 bytes with the virus being located at
the beginning of the file. The program's date and time in the DOS
disk directory listing will not appear to be altered, though the
seconds field will have been set to "60". The following text
strings are visible within the viral code:
"Andy said:Zarin is dangerous!"
Known variant(s) of Kobrin are:
Kobrin.491: Also received in January, 1996, this is a 491 byte
variant of the Kobrin virus described above. It infects in the
same manner, and also contains the same text strings.
Origin: Unknown January, 1996.