Virus Name: Kremikovtzi
V Status: Rare
Discovered: November, 1993
Symptoms: .COM & .EXE growth; system hangs; TSR; program corruption
Eff Length: 1,015 - 1,029 Bytes
Type Code: PRsAK - Parasitic Resident .COM & .EXE Infector
Detection Method: F-Prot, ViruScan, Sweep, AVTK, IBMAV,
NAV, NAVDX, VAlert, PCScan, ChAV,
NShld, Sweep/N, AVTK/N, IBMAV/N, Innoc, NAV/N, LProt
Removal Instructions: Delete infected programs
The Kremikovtzi virus was received in November, 1993. Its origin is
unknown, though it may be from the USSR. Kremikovtzi is a memory
resident infector of .COM and .EXE programs, including COMMAND.COM.
When the first Kremikovtzi infected program is executed, this virus
will install itself memory resident as a low system memory TSR of
approximately 1K in size. It hooks interrupt 21.
Once memory resident, Kremikovtzi will infect .COM and .EXE programs,
including COMMAND.COM, when they are executed or opened. Infected
programs will have a file length increase of 1,015 to 1,029 bytes
with the virus being located at the end of the file. The program's
date and time in the DOS disk directory listing will not be altered.
The following text string is visible within the viral code in all
Kremikovtzi infected programs:
It is unknown what Kremikovtzi does besides replicate.