SVC 3.1 Virus

 Virus Name:  SVC 3.1 
 Aliases:     SVC V3.1 
 V Status:    Rare 
 Discovered:  May, 1991 
 Symptoms:    .COM & .EXE growth; decrease in total system and available 
              free memory 
 Origin:      USSR 
 Eff Length:  1,064 Bytes 
 Type Code:   PRhAK - Parasitic Resident .COM & .EXE Infector 
 Detection Method:  ViruScan, AVTK, F-Prot, NAV, Sweep, IBMAV, PCScan, 
                    NAVDX, VAlert, ChAV, 
                    NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, 
                    NAV/N, IBMAV/N 
 Removal Instructions:  Delete infected files 
 General Comments: 
       The SVC 3.1 virus was received from Europe in May, 1991.  It is 
       originally from the USSR.  SVC 3.1 is a memory resident infector 
       of .COM and .EXE programs, including COMMAND.COM. 
       The first time a program infected with SVC 3.1 is executed, it 
       will install itself memory resident at the top of system memory 
       but below the 640K DOS boundary.  Total system and available free 
       memory, as measured by the DOS CHKDSK program, will decrease by 
       1,088 bytes.  Interrupt 12's return will not be moved.  Interrupt 
       21 will be hooked by the virus. 
       After SVC 3.1 is memory resident, it will infect .COM and .EXE 
       programs when they are executed.  If COMMAND.COM is executed, it 
       will become infected.  Infected programs will increase in size by 
       1,064 bytes with the virus being located at the end of the infected 
       file. The program's date and time in the DOS disk directory will 
       not be altered. 
       Programs infected with SVC 3.1 will contain the following text 
               "(c) 1990 by SVC,Vers. 3.1" 
       SVC 3.1 is an earlier version of the USSR 1689 virus.  Unlike 
       USSR 1689, it does not hang the system when the next program is 
       executed after becoming memory resident.  It also does not hide 
       the file length increase. 
       Known variant(s) of SVC 3.1 are: 
       SVC 3.1-CHR: Received in October, 1992, SVC 3.1-CHR is a 
                  modified version of the SVC 3.1 virus described above. 
                  Like the original virus, this variant adds 1,064 bytes 
                  to the .COM and .EXE programs it infects when they 
                  are executed.  The virus is located at the end of 
                  infected files.  The following text string can be found 
                  in the viral code in SVC 3.1-CHR infected programs: 
                  "(C) 1991 by CHR,Sverdlovsk" 
                  This variant is not detected by all anti-viral programs 
                  which can detect the original SVC 3.1 virus. 
                  Origin:  USSR  October, 1992. 
       See:   SVC 4.0   SVC 5.0   SVC 6.0   SVC-2936   SVC.3241 

Show viruses from discovered during that infect .

Main Page