SVC 4.0 Virus

Virus Name: SVC 4.0 Aliases: USSR 1689, Off Stealth, SVC V4.0, SVC 4.0-1740 V Status: Rare Discovered: December, 1990 Symptoms: .COM & .EXE growth; system hangs; file allocation errors Origin: USSR Eff Length: 1,689 Bytes Type Code: PRA - Parasitic Resident .COM & .EXE Infector Detection Method: ViruScan, AVTK, F-Prot, NAV, Sweep, IBMAV, PCScan, NAVDX, VAlert, ChAV, NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N Removal Instructions: Delete infected files General Comments: The SVC 4.0 virus was received in December, 1990. It is from the USSR. This virus is not a very viable virus, though it does infect both .COM and .EXE programs. When the first program infected with SVC 4.0 is executed, this virus will install itself memory resident in the in-memory command interpreter. After the virus is memory resident, the virus will infect the next .COM or .EXE program executed, though a system hang will also occur. Infected programs will increase in size by 1,689 bytes, though on files larger than 1,689 bytes, the virus will hide the file length increase if the virus is already in memory. Files originally smaller than 1,689 bytes will indicate a file size increase in the DOS directory when the virus is resident. In all cases, the virus will be located at the end of infected programs. With the system hang which occurs each time a program is infected by this virus, it is not a very viable virus, and should not be considered a threat in its current state. Known variant(s) of SVC 4.0 are: SVC 4.0-1740: A 1,740 byte variant of SVC 4.0, this variant has the bug fixed in the original virus which resulted in system hangs. It does not infect very small .COM files. The DOS CHKDSK program will return file allocation errors on all infected files when the virus is memory resident. The following text string can be found in infected files: "(c) 1990 by SVC,Vers. 4.0" Origin: USSR November, 1991 See: SVC 3.1 SVC 5.0 SVC 6.0 SVC-2936 SVC.3241