SVC 3.1 Virus
Virus Name: SVC 3.1
Aliases: SVC V3.1
V Status: Rare
Discovered: May, 1991
Symptoms: .COM & .EXE growth; decrease in total system and available
free memory
Origin: USSR
Eff Length: 1,064 Bytes
Type Code: PRhAK - Parasitic Resident .COM & .EXE Infector
Detection Method: ViruScan, AVTK, F-Prot, NAV, Sweep, IBMAV, PCScan,
NAVDX, VAlert, ChAV,
NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N,
NAV/N, IBMAV/N
Removal Instructions: Delete infected files
General Comments:
The SVC 3.1 virus was received from Europe in May, 1991. It is
originally from the USSR. SVC 3.1 is a memory resident infector
of .COM and .EXE programs, including COMMAND.COM.
The first time a program infected with SVC 3.1 is executed, it
will install itself memory resident at the top of system memory
but below the 640K DOS boundary. Total system and available free
memory, as measured by the DOS CHKDSK program, will decrease by
1,088 bytes. Interrupt 12's return will not be moved. Interrupt
21 will be hooked by the virus.
After SVC 3.1 is memory resident, it will infect .COM and .EXE
programs when they are executed. If COMMAND.COM is executed, it
will become infected. Infected programs will increase in size by
1,064 bytes with the virus being located at the end of the infected
file. The program's date and time in the DOS disk directory will
not be altered.
Programs infected with SVC 3.1 will contain the following text
string:
"(c) 1990 by SVC,Vers. 3.1"
SVC 3.1 is an earlier version of the USSR 1689 virus. Unlike
USSR 1689, it does not hang the system when the next program is
executed after becoming memory resident. It also does not hide
the file length increase.
Known variant(s) of SVC 3.1 are:
SVC 3.1-CHR: Received in October, 1992, SVC 3.1-CHR is a
modified version of the SVC 3.1 virus described above.
Like the original virus, this variant adds 1,064 bytes
to the .COM and .EXE programs it infects when they
are executed. The virus is located at the end of
infected files. The following text string can be found
in the viral code in SVC 3.1-CHR infected programs:
"(C) 1991 by CHR,Sverdlovsk"
This variant is not detected by all anti-viral programs
which can detect the original SVC 3.1 virus.
Origin: USSR October, 1992.
See: SVC 4.0 SVC 5.0 SVC 6.0 SVC-2936 SVC.3241