PV-81 Virus

Virus Name: PV-81 Aliases: V Status: Rare Discovery: March, 1993 Symptoms: .COM file growth; file date/time changes; system hangs Origin: Unknown Eff Length: 81 Bytes Type Code: PNCK - Parasitic Non-Resident .COM Infector Detection Method: Sweep, F-Prot, ViruScan, IBMAV, AVTK, NAV, NAVDX, VAlert, ChAV, Sweep/N, Innoc, NShld, NProt, AVTK/N, IBMAV/N, NAV/N Removal Instructions: Delete infected files General Comments: The PV-81 virus was submitted in March, 1993. Its origin or point of isolation. PV-81 is a primitive, non-resident direct action infector of .COM programs, including COMMAND.COM. When a program infected with the PV-81 virus is executed, the PV-81 virus will infect one or several of the .COM programs located in the current directory. Infected programs will have a file length increase of 81 bytes with the virus being located at the beginning of the file. Unfortunately, PV-81 cannot determine properly if it has previously infected a file, so it will reinfect them, adding an additional 81 bytes with each reinfection. After reinfection has occurred, viral code will be located at both the beginning and the end of the file. The program's date and time in the DOS disk directory listing will have been updated to the current system date and time when the last infection occurred. One text string is visible within the viral code in infected files: "*.COM" System hangs may occur when infected programs are executed. Other- wise, the virus doesn't do anything besides replicate.