ARCV Friends Virus

Virus Name: ARCV Friends Aliases: V Status: Rare Discovery: November, 1992 Symptoms: .COM file growth; file date/time changes; message Origin: England Eff Length: 839 Bytes Type Code: PNCK - Parasitic Non-Resident .COM Infector Detection Method: AVTK, F-Prot, ViruScan, Sweep, ChAV, NAV, IBMAV, NAVDX, VAlert, PCScan, NShld, Sweep/N, Innoc, AVTK/N, NProt, IBMAV/N, NAV/N, LProt Removal Instructions: Delete infected files General Comments: The ARCV Friends virus was received in October, 1992, from England. ARCV Friends is a non-resident infector of .COM programs, including COMMAND.COM. It is not related to the Friends virus. When a program infected with the ARCV Friends virus is executed, this virus will infect one .COM program located in the current directory. Infected programs will have a file length increase of 839 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory listing will be altered to the current system date and time when infection occurred. The ARCV Friends virus activates when an infected program is executed on April 12th of any year, resulting in the display of the following message on the system monitor: " [FRIENDS] ICE-9 (c) ICE-9 1992 released 5th September ARcV Productions. Dedicated to all my friends" The above text is encrypted within the virus, and is not visible within infected programs. The following text string is also encrypted within the viral code: "*.COM"