Kremikovtzi Virus

Virus Name: Kremikovtzi Aliases: V Status: Rare Discovered: November, 1993 Symptoms: .COM & .EXE growth; system hangs; TSR; program corruption Origin: Unknown Eff Length: 1,015 - 1,029 Bytes Type Code: PRsAK - Parasitic Resident .COM & .EXE Infector Detection Method: F-Prot, ViruScan, Sweep, AVTK, IBMAV, NAV, NAVDX, VAlert, PCScan, ChAV, NShld, Sweep/N, AVTK/N, IBMAV/N, Innoc, NAV/N, LProt Removal Instructions: Delete infected programs General Comments: The Kremikovtzi virus was received in November, 1993. Its origin is unknown, though it may be from the USSR. Kremikovtzi is a memory resident infector of .COM and .EXE programs, including COMMAND.COM. When the first Kremikovtzi infected program is executed, this virus will install itself memory resident as a low system memory TSR of approximately 1K in size. It hooks interrupt 21. Once memory resident, Kremikovtzi will infect .COM and .EXE programs, including COMMAND.COM, when they are executed or opened. Infected programs will have a file length increase of 1,015 to 1,029 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory listing will not be altered. The following text string is visible within the viral code in all Kremikovtzi infected programs: "RF *.COM" It is unknown what Kremikovtzi does besides replicate.