ARCV Friends Virus


 Virus Name:  ARCV Friends 
 Aliases:    
 V Status:    Rare 
 Discovery:   November, 1992 
 Symptoms:    .COM file growth; file date/time changes; message 
 Origin:      England 
 Eff Length:  839 Bytes 
 Type Code:   PNCK - Parasitic Non-Resident .COM Infector 
 Detection Method:  AVTK, F-Prot, ViruScan, Sweep, ChAV, 
                    NAV, IBMAV, NAVDX, VAlert, PCScan, 
                    NShld, Sweep/N, Innoc, AVTK/N, NProt, IBMAV/N, NAV/N, 
                    LProt 
 Removal Instructions:  Delete infected files 
 
 General Comments: 
       The ARCV Friends virus was received in October, 1992, from 
       England.  ARCV Friends is a non-resident infector of .COM programs, 
       including COMMAND.COM.  It is not related to the Friends virus. 
 
       When a program infected with the ARCV Friends virus is executed, 
       this virus will infect one .COM program located in the current 
       directory.  Infected programs will have a file length increase of 
       839 bytes with the virus being located at the end of the file.  The 
       program's date and time in the DOS disk directory listing will be 
       altered to the current system date and time when infection occurred. 
 
       The ARCV Friends virus activates when an infected program is executed 
       on April 12th of any year, resulting in the display of the following 
       message on the system monitor: 
 
               "       [FRIENDS]  ICE-9 
                        (c) ICE-9 1992 
                    released 5th September 
                       ARcV Productions. 
                  Dedicated to all my friends" 
 
       The above text is encrypted within the virus, and is not visible 
       within infected programs.  The following text string is also 
       encrypted within the viral code: 
 
               "*.COM" 

Show viruses from discovered during that infect .

Main Page