Kohn_6 Virus

 Virus Name:  Kohn_6 
 Aliases:     Kohn_6.633 
 V Status:    New 
 Discovered:  May, 1995 
 Symptoms:    .COM file growth; file date/time month changes; 
              file name displayed on system monitor 
 Origin:      Sweden or The Netherlands 
 Eff Length:  633 Bytes 
 Type Code:   PNCK - Parasitic Non-Resident .COM Infector 
 Detection Method:  F-Prot, NAV, AVTK, Sweep, IBMAV, NAVDX, VAlert, 
                    PCScan, ViruScan 2.51+, ChAV, 
                    Sweep/N, NProt, AVTK/N, IBMAV/N, NShld, NAV/N, 
                    LProt, Innoc 4.0+ 
 Removal Instructions:  Delete infected files 
 General Comments: 
       The Kohn_6 virus was submitted in May, 1995, and is from either 
       Sweden or The Netherlands.  Kohn_6 is a non-resident, direct 
       action virus which infects .COM programs, including COMMAND.COM. 
       When a program infected with the Kohn_6 virus is executed, this 
       virus will infect one .COM file located in the current directory. 
       The virus will then display the file name of the .COM file it has 
       infected.  Programs infected with the Kohn_6 virus will have a 
       file length increase of 633 bytes with the virus being located at 
       the end of the file.  The program's date and time in the DOS disk 
       directory listing will have the first digit altered.  The following 
       text strings are encrypted within the virus: 
       Kohn_6 doesn't appear to do anything besides replicate. 
       Known variant(s) of Kohn_6 are: 
       Kohn_6.638: Also received in May, 1995, Kohn_6.638 is a 638 byte 
           variant of the Kohn_6 virus described above.  It adds 638 bytes 
           to the .COM files it infects.  The file's date and time in the 
           DOS disk directory listing may have the month or the day field 
           in the file date altered.  It contains the same encrypted text 
           strings as the original virus. 
           Origin:  Sweden or The Netherlands  May, 1995. 

Show viruses from discovered during that infect .

Main Page