Virus Name: PCV
V Status: Rare
Discovered: June, 1991
Symptoms: TSR; .COM & .EXE growth; files may be deleted; file
Eff Length: 1,904 Bytes
Type Code: PRsA - Parasitic Resident .COM & .EXE Infector
Detection Method: ViruScan, F-Prot, Sweep, AVTK, IBMAV, NAV,
NAVDX, VAlert, PCScan, ChAV,
NShld, LProt, Sweep/N, NProt, AVTK/N, NAV/N,
Removal Instructions: Delete infected files
The PCV virus was submitted in June, 1991 from Italy. PCV is a
memory resident infector of .COM and .EXE programs. It does not
The first time a program infected with PCV is executed, PCV will
install itself memory resident as a low system memory TSR of 1,904
bytes. The virus will hook interrupt 21.
After PCV is memory resident, it will infect .COM and .EXE programs
as they are executed. .COM programs will increase in size by 1,904
bytes with the virus being located at the beginning of the infected
file. .EXE programs will increase in size by 1,910 to 1,918 bytes
with the virus being located at the end of infected files. The
file length increase, however, will mostly be hidden by the virus
if it is memory resident. The program's date and time in the disk
directory will not be altered.
Systems infected with PCV will notice that files disappear or are
deleted randomly from the current directory. These files may be
programs, .BAT files, or data files. Files may also disappear
when the user attempts to view them, such as with a file editor.
Programs which the user is attempting to execute may also be
deleted by the virus.
If the DOS CHKDSK program is executed with PCV memory resident, it
will indicate file allocation errors on infected programs.