SVir Virus

Virus Name: SVir Aliases: V Status: Endangered Discovered: 1990 Symptoms: .EXE growth; file date/time changes; system hangs Origin: Poland Eff Length: 512 Bytes Type Code: PNE - Parasitic Non-Resident .EXE Infector Detection Method: ViruScan, NAV, AVTK, F-Prot, Sweep, IBMAV, NAVDX, VAlert, PCScan, ChAV, NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N Removal Instructions: Delete infected programs General Comments: The SVir virus was originally isolated in Poland early in 1990. The original virus which was isolated had a fatal flaw in its code which prevented it from executing. In August, 1990, a sample was obtained from Fridrik Skulason which now does replicate. This second sample, identified as SVir-B, is a non-resident infector of .EXE files. A third variant was received in April, 1991. Each time a program infected with the SVir-B virus is executed, the virus will infect one .EXE file. Infected files will increase in length between 516 and 526 bytes with the virus's code appended to the end of the file. If the virus could not find an .EXE file to infect, it will leave the drive "spinning" as it will be in an endless loop looking for a file to infect. Interestingly enough, this virus will only infect files located on the A: drive. Infected files will also have their date/time in the disk directory changed to the date and time when the infection occurred. SVir, at least in the three known variants, does not do anything malicious, it simply replicates. Known variant(s) of SVir are: SVir-0: A variant received in April, 1991, this variant is very similar to SVir-B. When an infected program is executed, the virus may infect either 1 or 2 previously uninfected .EXE files in the current directory. Execution of some infected programs may result in a system hang. SVir-A: The original "virus" from Poland in early 1990 which did not replicate. SVir-B: A variant isolated in August, 1990 which has the bug in SVir-A fixed so that it will now replicate.