KoKo Virus is a

memory resident A terminate-and-stay-resident program (commonly TSR) is a computer program running under DOS that uses a system call to return control to DOS as though it has finished, but remains in computer memory so it can be reactivated later. This technique ...

computer virus A computer virus is a type of computer program that, when executed, replicates itself by modifying other computer programs and inserting its own code. If this replication succeeds, the affected areas are then said to be "infected" with a compu ...

created in March 1991. KoKo's name came from the creator himself, which was a nickname used by his friends. Many on-line virus databases refer to KoKo as ''Koko.1780''. KoKo is written in the

Assembly Assembly may refer to: Organisations and meetings * Deliberative assembly, a gathering of members who use parliamentary procedure for making decisions * General assembly, an official meeting of the members of an organization or of their representa ...

programming language and the executable file usually has an approximate file size of around 1780 bytes. The KoKo virus infects the target system by hooking the

Windows Windows is a group of several proprietary graphical operating system families developed and marketed by Microsoft. Each family caters to a certain sector of the computing industry. For example, Windows NT for consumers, Windows Server for serv ...

interrupt

INT 21h The DOS API is an API which originated with 86-DOS and is used in MS-DOS/ PC DOS and other DOS-compatible operating systems. Most calls to the DOS API are invoked using software interrupt 21h ( INT 21h). By calling INT 21h with a subfunctio ...

and writes itself to the end of

COM Com or COM may refer to: Computing * COM (hardware interface), a serial port interface on IBM PC-compatible computers * COM file, or .com file, short for "command", a file extension for an executable file in MS-DOS * .com, an Internet top-level d ...

and EXE files that are executed. The

payload Payload is the object or the entity which is being carried by an aircraft or launch vehicle. Sometimes payload also refers to the carrying capacity of an aircraft or launch vehicle, usually measured in terms of weight. Depending on the nature of ...

of this virus activates on July 29 and February 15. When activated the virus displays a message and may erase the computers

disk sector In computer disk storage, a sector is a subdivision of a track on a magnetic disk or optical disc. Each sector stores a fixed amount of user-accessible data, traditionally 512 bytes for hard disk drives (HDDs) and 2048 bytes for CD-ROMs and D ...

s. {{clear The message displayed on an infected system is: Stop Keyboard Clicking KoKo is Sleeping in Your PC. ! To Scan & Clean Call, Adham H. Hammam Fax & Phone (20) 066 - 261841

External links

Koko.1780 at Virus database
(Archived)
Koko.1780 at Prosecure

Koko.1780 at Panda Security
DOS file viruses Windows file viruses