Virus Name: Kohn_6
V Status: New
Discovered: May, 1995
Symptoms: .COM file growth; file date/time month changes;
file name displayed on system monitor
Origin: Sweden or The Netherlands
Eff Length: 633 Bytes
Type Code: PNCK - Parasitic Non-Resident .COM Infector
Detection Method: F-Prot, NAV, AVTK, Sweep, IBMAV, NAVDX, VAlert,
PCScan, ViruScan 2.51+, ChAV,
Sweep/N, NProt, AVTK/N, IBMAV/N, NShld, NAV/N,
LProt, Innoc 4.0+
Removal Instructions: Delete infected files
The Kohn_6 virus was submitted in May, 1995, and is from either
Sweden or The Netherlands. Kohn_6 is a non-resident, direct
action virus which infects .COM programs, including COMMAND.COM.
When a program infected with the Kohn_6 virus is executed, this
virus will infect one .COM file located in the current directory.
The virus will then display the file name of the .COM file it has
infected. Programs infected with the Kohn_6 virus will have a
file length increase of 633 bytes with the virus being located at
the end of the file. The program's date and time in the DOS disk
directory listing will have the first digit altered. The following
text strings are encrypted within the virus:
Kohn_6 doesn't appear to do anything besides replicate.
Known variant(s) of Kohn_6 are:
Kohn_6.638: Also received in May, 1995, Kohn_6.638 is a 638 byte
variant of the Kohn_6 virus described above. It adds 638 bytes
to the .COM files it infects. The file's date and time in the
DOS disk directory listing may have the month or the day field
in the file date altered. It contains the same encrypted text
strings as the original virus.
Origin: Sweden or The Netherlands May, 1995.