SVC.3241 Virus

Virus Name: SVC.3241 Aliases: V Status: New Discovered: February, 1994 Symptoms: .COM & .EXE growth; file date/time seconds set to "58"; decrease in total system and available free memory Origin: Unknown Eff Length: 3,241 Bytes Type Code: PRhA - Parasitic Resident .COM & .EXE Infector Detection Method: F-Prot, AVTK, ViruScan, IBMAV, Sweep, NAV, NAVDX, VAlert, PCScan, NProt, AVTK/N, NShld, Sweep/N, IBMAV/N, NAV/N Removal Instructions: Delete infected files General Comments: The SVC.3241 virus was received in February, 1994. Its origin or point of isolation is unknown. SVC.3241 is a memory resident infector of .COM and .EXE programs, but not COMMAND.COM. It is a stealth virus, hiding the file length increase on infected files as well as disinfecting programs as they are read into memory. The first time a program infected with SVC.3241 is executed, it will install itself memory resident at the top of system memory but below the 640K DOS boundary. Total system and available free memory, as measured by the DOS CHKDSK program, will decrease by 3,264 bytes. Interrupt 12's return will not be moved. Interrupts 01, 03, 08, 13, and 21 will be hooked by the virus. After SVC.3241 is memory resident, it will infect .COM and .EXE programs when they are executed. Infected programs will increase in size by 3,241 bytes with the virus being located at the end of the file. The file length increase, however, will not be visible when SVC.3241 is memory resident as the virus disinfects programs as they, or their directory and FAT entries, are read into memory. The program's date and time in the DOS disk directory listing will appear to be unaltered, but the seconds field will have been set to "58". It is unknown what SVC.3241 does besides replicate. See: SVC 3.1 SVC 4.0 SVC 5.0 SVC 6.0 SVC-2936