Virus Database

Caz Family

Description Caz Family

These are dangerous memory resident viruses which hook INT 8, 21h, 2Fh and infect by standard way COM- and EXE-files which are started. If the file CLEAN.* is executed then these viruses decrypt and type the message "Virus anti-McAfee v1.0 (C) SEPTEMBER 1991 Made in SPAIN", then they erase the MBR of the hard drive and reboot the computer. Sometimes "Caz.1024" outputs to EGA/CGA video ports. These viruses contain the internal strings:
EXECOMC:COMMAND.COM CLEAN.

Check other viruses! Be aware! Use Antiviral Software

KOH.a

Description KOH.a

It's a memory resident boot virus. It hooks INT 09h (keyboard) and INT 13h. On loading from infected floppy it asks user for permission to infect hard drive:
KOH-Encrypt your HARD DISK now (please backup first)?

and infects HD on 'Y' answer, in another case it returns control to normal booting. On infection of hard drive this virus encrypts its sectors, the virus asks passwords before infection:
Now, enter 2 passwords, 1 for HD, 1 for FD. FD PW can be changed anytime
with Ctrl/Alt-K, C/A-O stops FD infect, C/A-H uninstalls on HD. Enter HD
PW at power up. WRITE THIS DOWN!
CASUAL encryption=fast but breakable--keeps out snoops.
STRONG encryption=good but slow--keeps out all. Use disk cache.
Do you want STRONG encryption?

On loading from infected HD the virus asks for password and lets booting on true answer only. This virus infects/encrypts floppy disks also. It can decrypt disks and uninstall itself on Ctrl-Alt-K,O,H keyboard keys. This virus contains and displays other strings also:
Initial load failedall aborting.
Load successful. A: now infected with KOH.
Sure you want to uninstall?
Should change be permanent?
Enter FLOPPY PW now.
Now enter HD PW.
Enter
Password:
Verify Password:
Verify failed!
KOHv1.00

Kohntark.K-CMOS.929

Description Kohntark.K-CMOS.929
It is a dangerous nonmemory resident parasitic encrypted virus. It searches for COM and EXE files and writes itself to the end of the file. It erases CMOS memory. It contains the text string:
K-CMöS / Köhntark

Kohntark.Kompanion
It is a harmless nonmemory resident companion virus. It searches for .EXE files and creates companion .COM files. It contains the text strings:
EXECOM
KöMPANION / Köhntark

Home