Kohn_6 Virus

Virus Name: Kohn_6 Aliases: Kohn_6.633 V Status: New Discovered: May, 1995 Symptoms: .COM file growth; file date/time month changes; file name displayed on system monitor Origin: Sweden or The Netherlands Eff Length: 633 Bytes Type Code: PNCK - Parasitic Non-Resident .COM Infector Detection Method: F-Prot, NAV, AVTK, Sweep, IBMAV, NAVDX, VAlert, PCScan, ViruScan 2.51+, ChAV, Sweep/N, NProt, AVTK/N, IBMAV/N, NShld, NAV/N, LProt, Innoc 4.0+ Removal Instructions: Delete infected files General Comments: The Kohn_6 virus was submitted in May, 1995, and is from either Sweden or The Netherlands. Kohn_6 is a non-resident, direct action virus which infects .COM programs, including COMMAND.COM. When a program infected with the Kohn_6 virus is executed, this virus will infect one .COM file located in the current directory. The virus will then display the file name of the .COM file it has infected. Programs infected with the Kohn_6 virus will have a file length increase of 633 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory listing will have the first digit altered. The following text strings are encrypted within the virus: "*.COM" "????????COM?" Kohn_6 doesn't appear to do anything besides replicate. Known variant(s) of Kohn_6 are: Kohn_6.638: Also received in May, 1995, Kohn_6.638 is a 638 byte variant of the Kohn_6 virus described above. It adds 638 bytes to the .COM files it infects. The file's date and time in the DOS disk directory listing may have the month or the day field in the file date altered. It contains the same encrypted text strings as the original virus. Origin: Sweden or The Netherlands May, 1995.