Virus Name: SVC.3241
V Status: New
Discovered: February, 1994
Symptoms: .COM & .EXE growth; file date/time seconds set to "58";
decrease in total system and available free memory
Eff Length: 3,241 Bytes
Type Code: PRhA - Parasitic Resident .COM & .EXE Infector
Detection Method: F-Prot, AVTK, ViruScan, IBMAV, Sweep,
NAV, NAVDX, VAlert, PCScan,
NProt, AVTK/N, NShld, Sweep/N, IBMAV/N, NAV/N
Removal Instructions: Delete infected files
The SVC.3241 virus was received in February, 1994. Its origin or
point of isolation is unknown. SVC.3241 is a memory resident
infector of .COM and .EXE programs, but not COMMAND.COM. It is a
stealth virus, hiding the file length increase on infected files as
well as disinfecting programs as they are read into memory.
The first time a program infected with SVC.3241 is executed, it
will install itself memory resident at the top of system memory
but below the 640K DOS boundary. Total system and available free
memory, as measured by the DOS CHKDSK program, will decrease by
3,264 bytes. Interrupt 12's return will not be moved. Interrupts
01, 03, 08, 13, and 21 will be hooked by the virus.
After SVC.3241 is memory resident, it will infect .COM and .EXE
programs when they are executed. Infected programs will increase
in size by 3,241 bytes with the virus being located at the end of
the file. The file length increase, however, will not be visible
when SVC.3241 is memory resident as the virus disinfects programs
as they, or their directory and FAT entries, are read into memory.
The program's date and time in the DOS disk directory listing
will appear to be unaltered, but the seconds field will have been
set to "58".
It is unknown what SVC.3241 does besides replicate.
See: SVC 3.1 SVC 4.0 SVC 5.0 SVC 6.0 SVC-2936