Kthulhu Virus

 Virus Name:  Kthulhu 
 V Status:    Rare 
 Discovered:  December, 1992 
 Symptoms:    .COM file growth; message displayed; system hangs; 
              write protect errors on diskettes 
 Origin:      Poland 
 Eff Length:  512 Bytes 
 Type Code:   PNCK - Parasitic Non-Resident .COM Infector 
 Detection Method:  ViruScan, AVTK, F-Prot, Sweep, IBMAV, 
                    NAV, NAVDX, VAlert, PCScan, ChAV, 
                    NShld, Sweep/N, NProt, AVTK/N, LProt, NAV/N, IBMAV/N, 
 Removal Instructions:  Delete infected programs 
 General Comments: 
       The Kthulhu virus was submitted in December, 1992.  It is originally 
       from Poland.  Kthulhu is a non-resident, direct action infector of 
       .COM programs, including COMMAND.COM. 
       When a program infected with the Kthulhu virus is executed, the 
       Kthulhu virus will infect all of the .COM programs located in the 
       current directory.  Infected programs will have a file length 
       increase of 512 bytes with the virus being located at the beginning 
       of the file.  The program's date and time in the DOS disk directory 
       listing will not be altered.  The following text strings can be 
       found within the viral code in all Kthulhu infected programs: 
               "KTHULHU Today is my birthday." 
               "IT $is coming." 
               "$has gone." 
       The Kthulhu virus activates when an infected program is executed 
       during the month of May of any year, displaying a message.  A 
       system hang also occurs.  The text of the message depends on what 
       the day of the month is set to in the system time.  From the 1st 
       of May thru May 19th, the message displayed is: 
               "IT is coming." 
       On May 20th, it displays the message: 
               "Today is my birthday." 
       From May 21st thru May 31st, it displays the message: 
               "IT has gone. 
       An additional symptom of a Kthulhu infection is that attempts to 
       execute programs on write protected diskettes will result in a 
       write protect error. 

Show viruses from discovered during that infect .

Main Page