     Noki.448
     
     Noki.448 is a very dangerous memory resident parasitic virus.
     While executing, the virus copies its code into the video memory at
     the address BD00:0000, and saves its code on the hard drive into
     sector 17 (17/0/0 - sector/track/head). Then the virus copies its
     INT 21h handler code (39 bytes) into Interrupt Vectors Table, hooks
     INT 21h, and returns the control to the host file.
     
     The virus intercepts the file execution (AX=4B00h), reads its code
     from hard drive sector 17 to the video memory, and jumps into there.
     The infection routine receives the control, and infects the
     EXE-files which have the 448-bytes "cave" of zero bytes. The virus
     overwrites that cave, and returns from infection routine. So the
     file length does not grow during infection.
     
     On the 17th of odd months (January,March,...) the virus corrupts the
     MBR of the hard drive. The virus contains the internal text string:

 NOKI

     &copy; Copyright 1995 Eugene V. Kaspersky - All Rights reserved.
     GV291195
