Virus Name: Kolumna
V Status: New
Discovered: January, 1995
Symptoms: .COM & .EXE growth; beeping; system hangs;
decrease in available free memory;
file date/time seconds = "62"
Eff Length: 2,048 Bytes
Type Code: PRhA - Parasitic Resident .COM & .EXE Infector
Detection Method: F-Prot, IBMAV, AVTK, Sweep, ViruScan, NAVDX,
VAlert, NAV, ChAV, PCScan,
NProt, IBMAV/N, AVTK/N, Sweep/N, NShld, NAV/N, Innoc 4.0+
Removal Instructions: Delete infected files
The Kolumna virus was received in January, 1995. Its origin or point
of isolation is unknown. Kolumna is a memory resident infector of
.COM and .EXE files, but not COMMAND.COM. It does not infect small
.COM and .EXE files.
When the first Kolumna infected program is executed, this virus will
install itself memory resident at the top of system memory but below
the 640K DOS boundary, hooking interrupt 21. Available free memory,
as indicated by the DOS CHKDSK program from DOS 5.0, will have
decreased by approximately 4,576 bytes. Once memory resident, any
keystrokes on the system keyboard will be accompanied by a beep being
emitted on the system speaker.
Once the Kolumna virus is memory resident, it will infect .COM and
.EXE files when they are executed. Infected programs will have a
file length increase of 2,048 bytes with the virus being located at
the end of the file. The program's date and time in the DOS disk
directory listing will not appear to be altered, though the seconds
field will have been set to "62". The following text strings are
encrypted within the viral code:
"I co teraz doktorku ?"
"Robal to ja !"
"Uprasza sie o niegrzebanie w cudzych wirusach."
"!! KOPIOWANIE ZABRONIONE !!"
"PLEASE DO NOT MAKE ILLEGAL COPIES OF THIS SOFTWARE"
"(...) Kolumna prochu nad pochodem."
"Rozstapi si posffuszne morze"
"Ze jdziemy nisko do czeluptci"
"Do pustych piekieff, oraz wy ej"
"Nieba sprawdzamy nieprawdziwo"
"I wyzwolony od przestrachu"
"W piasek si& zamieni caffy pochod"
"niesiony przez szyderczy wiatr."
"I tak ostatnie echo przejdzie"
"Po nieposffusznej pleptni ziemi"
"Zostanie tylko b&ben (...)."
"Wskoczcie do klozetu i stancie na glowie"
"ja zyje, a wyscie umarli panowie !"
When the Kolumna virus is memory resident, batch files may fail to
function properly. Frequent system hangs also occur when the user
attempt to enter commands or execute programs on the system
Known variant(s) of Kolumna are:
Kolumna.1100: Received in January, 1996, this is a 1,100 byte
variant of the Kolumna virus described above. Its size in
memory is 2,416 bytes, hooking interrupt 21. It infects .COM
and .EXE files, though not small ones nor COMMAND.COM, when
they are executed. Infected files will have a file length
increase of 1,100 bytes with the virus being located at the
end of the file. The program's date and time in the DOS disk
directory listing will not be altered. The following text
strings are encrypted within the viral code:
"I co sie tak gapisz wypierdku ?"
Origin: Unknown January, 1996.