Type File virus
Creator Köhntark
Date Discovered 1994.07.24
Place of Origin United States
Source Language
Platform DOS
File Type(s) .com, .exe
Infection Length 697 bytes
Reported Costs

Kaos4 is a direct-action file infecting virus that gained some prominence in the mid 1990's. It can cause system hangs under certain conditions.


When a file infected with Kaos4 is executed, it appends itself one .com and one .exe file in the current directory. The virus will modify the seconds field for the program's modification date and time to 62 or 58, but the rest will stay the same. If PATH is not set, the system will hang.

It contains the text "KAOS4 / Köhntark", Köhntark being the alias of the creator. In some binary editors, it may appear as K"hntark, as they may not have the encoding for the umlaut.


Kaos4 was first distributed in a post to the usenet newsgroup alt.binaries.pictures.erotica. The virus is reported to have spread very fast, starting in the United States and making it to Europe, particularly Germany, Austria, Norway and Finland.

Other Facts

Köhntark is also the name of a thirty-minute track by a French progressive rock band from 1975. This group seems to have a tendency to use umlauts in a large number of its song titles. Gratuitous use of umlauts began about this time, actually starting with progressive bands, but becoming most associated with heavy metal.


Mikko Hypponen. F-Secure Antivirus, F-Secure Virus Descriptions : Kaos4.

ESET Threat Encyclopedia, Kaos4.

Trend Micro Antivirus, KAOS4.A.

ProgReviews, Magma Live/Hhai.

Unless otherwise stated, the content of this page is licensed under Creative Commons Attribution-NonCommercial-ShareAlike 3.0 License