SVC-2936 Virus

Virus Name: SVC-2936 Aliases: V Status: New Discovered: August, 1993 Symptoms: .COM & .EXE growth; decrease in total system and available free memory Origin: Unknown Eff Length: 2,936 Bytes Type Code: PRhA - Parasitic Resident .COM & .EXE Infector Detection Method: ViruScan, AVTK, F-Prot, IBMAV, Sweep, NAV, NAVDX, VAlert, PCScan, ChAV, AVTK/N, NShld, Sweep/N, NProt, NAV/N, IBMAV/N, Innoc, LProt Removal Instructions: Delete infected files General Comments: The SVC-2936 virus was received in August, 1993. Its origin or point of isolation is unknown. SVC-2936 is a memory resident infector of .COM and .EXE programs, but not COMMAND.COM. The first time a program infected with SVC-2936 is executed, it will install itself memory resident at the top of system memory but below the 640K DOS boundary. Total system and available free memory, as measured by the DOS CHKDSK program, will decrease by 2,960 bytes. Interrupt 12's return will not be moved. Interrupts 01, 03, 08, 13, and 21 will be hooked by the virus. After SVC-2936 is memory resident, it will infect .COM and .EXE programs when they are executed. Infected programs will increase in size by 2,936 bytes with the virus being located at the end of the file. The file length increase, however, will not be visible when SVC-2936 is memory resident as the virus disinfects programs as they, or their directory and FAT entries, are read into memory. The program's date and time in the DOS disk directory listing will not be altered. Programs infected with SVC-2936 will contain the following text string at the very end of all infected files, though it can only be seen in files when the virus is not memory resident: "5Fr" It is unknown what SVC-2936 does besides replicate. See: SVC 3.1 SVC 4.0 SVC 5.0 SVC 6.0 SVC.3241