ARCV Xmas Virus

Virus Name: ARCV Xmas Aliases: V Status: Rare Discovery: March, 1993 Symptoms: .COM file growth; message Origin: England Eff Length: 670 Bytes Type Code: PNCK - Parasitic Non-Resident .COM Infector Detection Method: AVTK, Sweep, ViruScan, IBMAV, F-Prot, NAV, NAVDX, VAlert, PCScan, ChAV, Sweep/N, NShld, AVTK/N, NProt, IBMAV/N, Innoc, NAV/N, LProt Removal Instructions: Delete infected files General Comments: The ARCV Xmas virus was submitted in March, 1993, and is originally from England. ARCV Xmas is a non-resident, direct action infector of .COM programs, including COMMAND.COM. It displays a message during the Christmas season. When a program infected with the ARCV Xmas virus is executed, this virus will infect one .COM program located in the current directory, though it does not infect .COM programs smaller than the virus itself. Infected programs will have a file length increase of 670 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory listing will not be altered. The following text strings are encrypted within the ARCV Xmas viral code in all infected files: "Happy Xmas from The ARCV." "*.com *.*" On December 20th through December 25th in years after 1992, the ARCV Xmas virus will display the following message when an infected program is executed: "Happy Xmas from The ARCV."