ARCV Xmas Virus

 Virus Name:  ARCV Xmas 
 V Status:    Rare 
 Discovery:   March, 1993 
 Symptoms:    .COM file growth; message 
 Origin:      England 
 Eff Length:  670 Bytes 
 Type Code:   PNCK - Parasitic Non-Resident .COM Infector 
 Detection Method:  AVTK, Sweep, ViruScan, IBMAV, F-Prot, 
                    NAV, NAVDX, VAlert, PCScan, ChAV, 
                    Sweep/N, NShld, AVTK/N, NProt, IBMAV/N, Innoc, NAV/N, 
 Removal Instructions:  Delete infected files 
 General Comments: 
       The ARCV Xmas virus was submitted in March, 1993, and is originally 
       from England.  ARCV Xmas is a non-resident, direct action infector 
       of .COM programs, including COMMAND.COM.  It displays a message 
       during the Christmas season. 
       When a program infected with the ARCV Xmas virus is executed, this 
       virus will infect one .COM program located in the current directory, 
       though it does not infect .COM programs smaller than the virus 
       itself.  Infected programs will have a file length increase of 670 
       bytes with the virus being located at the end of the file.  The 
       program's date and time in the DOS disk directory listing will not 
       be altered.  The following text strings are encrypted within the 
       ARCV Xmas viral code in all infected files: 
               "Happy Xmas from The ARCV." 
               "*.com *.*" 
       On December 20th through December 25th in years after 1992, the 
       ARCV Xmas virus will display the following message when an infected 
       program is executed: 
               "Happy Xmas from The ARCV." 

Show viruses from discovered during that infect .

Main Page