Krivmous Virus
Virus Name: Krivmous
Aliases:
V Status: Rare
Discovered: June, 1992
Symptoms: .COM & .EXE growth; message displayed; system hang
Origin: Bulgaria
Eff Length: 972 - 993 Bytes
Type Code: PNA - Parasitic Non-Resident .COM & .EXE Infector
Detection Method: ViruScan, AVTK, Sweep, F-Prot, IBMAV,
NAV, NAVDX, VAlert, PCScan, ChAV,
NShld, Sweep/N, Innoc, AVTK/N, LProt, NAV/N, IBMAV/N
Removal Instructions: Delete infected programs
General Comments:
The Krivmous was received in June 1992. It is originally from
Bulgaria. Krivmous is a non-resident direct action infector of
.COM and .EXE programs, but not COMMAND.COM. It will occassionally
display a message and have the system appear to be hung when an
infected program is executed.
When a program infected with the Krivmous virus is executed, this
virus will search the current directory to determine if there is
an uninfected .EXE program which the virus can infect. If an
uninfected .EXE program is found, the virus will infect it and
then the program the user was attempting to execute will run. If
an uninfected .EXE program was not found, the virus will then check
the current directory to determine if an uninfected .COM file can
be found, and infect it.
.COM programs infected by the Krivmous virus will have a file
length increase of 979 bytes with the virus being located at the
beginning of the file. .EXE programs will have a file length
increase of 972 to 993 bytes with the virus being located at the
end of the file. The program's date and time in the DOS disk
directory listing will not be altered.
The Krivmous virus will occassionally display the following poem
when the user executes an infected program. The system will then
appear to be hung, though pressing CTL-C will usually return the
user to the DOS prompt:
"There was a crooked man, and he went a crooked mile,
He found a crooked sixpence against a crooked stile,
He bought a crooked cat, which caught a crooked mouse,
And they all lived together in a little crooked house."
The above message is not visible within infected programs as it
is encrypted within the virus.
Known variant(s) of Krivmous are:
Krivmous-B: Functionally equivalent to the Krivmous virus
described above, this variant has five bytes which
differ.
Origin: Bulgaria June, 1992