NTKC Virus

Virus Name: NTKC Aliases: C-23963 V Status: Rare Discovered: December, 1990 Symptoms: .COM file growth; graphic picture Origin: USSR Eff Length: 23,963 Bytes Type Code: PNCK - Parasitic Non-Resident .COM Infector Detection Method: ViruScan, NAV, F-Prot, Sweep, AVTK, IBMAV, NAVDX, VAlert, PCScan, ChAV, NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N Removal Instructions: Delete infected files General Comments: The NTKC virus was received in May, 1991. It is originally from the USSR in December, 1990. NTKC is based on the Father Christmas virus. It is a non-resident direct action infector of .COM programs, including COMMAND.COM. When a program infected with NTKC is executed, the virus will search the current directory for a .COM program to infect. If one is found, it will become infected. Then, the virus will display a full screen graphic of a personal computer, the screen will be cleared, and the host program will execute. Programs infected with NTKC will have a file length increase of 23,963 bytes. The virus will be located at the end of the infected file. Text strings which will be found in NTKC infected programs are: "*.COM" "????????COM" "regional engeneering centre" "LENINFORMATIKA N T K C Computer-Service" See: Father Christmas