PCV Virus

Virus Name: PCV Aliases: PCVRSDS V Status: Rare Discovered: June, 1991 Symptoms: TSR; .COM & .EXE growth; files may be deleted; file allocation errors Origin: Italy Eff Length: 1,904 Bytes Type Code: PRsA - Parasitic Resident .COM & .EXE Infector Detection Method: ViruScan, F-Prot, Sweep, AVTK, IBMAV, NAV, NAVDX, VAlert, PCScan, ChAV, NShld, LProt, Sweep/N, NProt, AVTK/N, NAV/N, IBMAV/N, Innoc Removal Instructions: Delete infected files General Comments: The PCV virus was submitted in June, 1991 from Italy. PCV is a memory resident infector of .COM and .EXE programs. It does not infect COMMAND.COM. The first time a program infected with PCV is executed, PCV will install itself memory resident as a low system memory TSR of 1,904 bytes. The virus will hook interrupt 21. After PCV is memory resident, it will infect .COM and .EXE programs as they are executed. .COM programs will increase in size by 1,904 bytes with the virus being located at the beginning of the infected file. .EXE programs will increase in size by 1,910 to 1,918 bytes with the virus being located at the end of infected files. The file length increase, however, will mostly be hidden by the virus if it is memory resident. The program's date and time in the disk directory will not be altered. Systems infected with PCV will notice that files disappear or are deleted randomly from the current directory. These files may be programs, .BAT files, or data files. Files may also disappear when the user attempts to view them, such as with a file editor. Programs which the user is attempting to execute may also be deleted by the virus. If the DOS CHKDSK program is executed with PCV memory resident, it will indicate file allocation errors on infected programs.