Kommuna Virus

Virus Name: Kommuna Aliases: Kommuna.801 V Status: New Discovered: January, 1995 Symptoms: .COM file growth; file date changed to 4-26-80; message Origin: Unknown Eff Length: 801 Bytes Type Code: PNCK - Parasitic Non-Resident .COM Infector Detection Method: F-Prot, IBMAV, AVTK, Sweep, ViruScan, NAV, NAVDX, VAlert, PCScan, ChAV, NProt, IBMAV/N, AVTK/N, Sweep/N, NShld, NAV/N, Innoc 4.0+ Removal Instructions: Delete infected files General Comments: The Kommuna virus was received in January, 1995. Its origin or point of isolation is unknown. Kommuna is a non-resident, direct action infector of .COM files, including COMMAND.COM. It may display a text or graphic moving message when an infected program is executed. When a program infected with the Kommuna virus is executed, this virus will infect one .COM file located in the current directory. Programs infected with the Kommuna virus will have a file length increase of 801 bytes with the virus being located at the end of the file. The program's time in the DOS disk directory listing will not be altered, but the file's date will be changed to 4-26-80. The following text strings are visible within the viral code in all Kommuna infected programs: "*.com" "Don't warry please !!!" "parovozik" "KOMMUNA(OSTANOVKA)" ".com" "ommand.com" A graphic message of a train moving across the middle of the screen from right to left may be displayed when an infected program is executed. The train stops at the left of the screen, covering what appears to be a train station. The text string "parovozik" appears within the body of the train, while the text string "KOMMUNA(OSTANOVKA)" appears above the station. The virus may also display the message "Don't warry please !!!" when an infected program is executed.