| Kaos4 | |
|---|---|
| Type | File virus |
| Creator | Köhntark |
| Date Discovered | 1994.07.24 |
| Place of Origin | United States |
| Source Language | |
| Platform | DOS |
| File Type(s) | .com, .exe |
| Infection Length | 697 bytes |
| Reported Costs | |
Kaos4 is a direct-action file infecting virus that gained some prominence in the mid 1990's. It can cause system hangs under certain conditions.
Behavior
When a file infected with Kaos4 is executed, it appends itself one .com and one .exe file in the current directory. The virus will modify the seconds field for the program's modification date and time to 62 or 58, but the rest will stay the same. If PATH is not set, the system will hang.
It contains the text "KAOS4 / Köhntark", Köhntark being the alias of the creator. In some binary editors, it may appear as K"hntark, as they may not have the encoding for the umlaut.
Effects
Kaos4 was first distributed in a post to the usenet newsgroup alt.binaries.pictures.erotica. The virus is reported to have spread very fast, starting in the United States and making it to Europe, particularly Germany, Austria, Norway and Finland.
Other Facts
Köhntark is also the name of a thirty-minute track by a French progressive rock band from 1975. This group seems to have a tendency to use umlauts in a large number of its song titles. Gratuitous use of umlauts began about this time, actually starting with progressive bands, but becoming most associated with heavy metal.
Sources
Mikko Hypponen. F-Secure Antivirus, F-Secure Virus Descriptions : Kaos4.
ESET Threat Encyclopedia, Kaos4.
Trend Micro Antivirus, KAOS4.A.
ProgReviews, Magma Live/Hhai.