Virus Name: SVC-2936
V Status: New
Discovered: August, 1993
Symptoms: .COM & .EXE growth;
decrease in total system and available free memory
Eff Length: 2,936 Bytes
Type Code: PRhA - Parasitic Resident .COM & .EXE Infector
Detection Method: ViruScan, AVTK, F-Prot, IBMAV, Sweep, NAV,
NAVDX, VAlert, PCScan, ChAV,
AVTK/N, NShld, Sweep/N, NProt, NAV/N, IBMAV/N, Innoc,
Removal Instructions: Delete infected files
The SVC-2936 virus was received in August, 1993. Its origin or
point of isolation is unknown. SVC-2936 is a memory resident
infector of .COM and .EXE programs, but not COMMAND.COM.
The first time a program infected with SVC-2936 is executed, it
will install itself memory resident at the top of system memory
but below the 640K DOS boundary. Total system and available free
memory, as measured by the DOS CHKDSK program, will decrease by
2,960 bytes. Interrupt 12's return will not be moved. Interrupts
01, 03, 08, 13, and 21 will be hooked by the virus.
After SVC-2936 is memory resident, it will infect .COM and .EXE
programs when they are executed. Infected programs will increase
in size by 2,936 bytes with the virus being located at the end of
the file. The file length increase, however, will not be visible
when SVC-2936 is memory resident as the virus disinfects programs
as they, or their directory and FAT entries, are read into memory.
The program's date and time in the DOS disk directory listing
will not be altered.
Programs infected with SVC-2936 will contain the following text
string at the very end of all infected files, though it can only
be seen in files when the virus is not memory resident:
It is unknown what SVC-2936 does besides replicate.
See: SVC 3.1 SVC 4.0 SVC 5.0 SVC 6.0 SVC.3241