Virus Name: SVir
V Status: Endangered
Symptoms: .EXE growth; file date/time changes; system hangs
Eff Length: 512 Bytes
Type Code: PNE - Parasitic Non-Resident .EXE Infector
Detection Method: ViruScan, NAV, AVTK, F-Prot, Sweep,
IBMAV, NAVDX, VAlert, PCScan, ChAV,
NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, NAV/N,
Removal Instructions: Delete infected programs
The SVir virus was originally isolated in Poland early in 1990.
The original virus which was isolated had a fatal flaw in its code
which prevented it from executing. In August, 1990, a sample was
obtained from Fridrik Skulason which now does replicate. This
second sample, identified as SVir-B, is a non-resident infector of
.EXE files. A third variant was received in April, 1991.
Each time a program infected with the SVir-B virus is executed, the
virus will infect one .EXE file. Infected files will increase in
length between 516 and 526 bytes with the virus's code appended to
the end of the file. If the virus could not find an .EXE file to
infect, it will leave the drive "spinning" as it will be in an
endless loop looking for a file to infect.
Interestingly enough, this virus will only infect files located on
the A: drive.
Infected files will also have their date/time in the disk directory
changed to the date and time when the infection occurred.
SVir, at least in the three known variants, does not do anything
malicious, it simply replicates.
Known variant(s) of SVir are:
SVir-0: A variant received in April, 1991, this variant is very
similar to SVir-B. When an infected program is executed,
the virus may infect either 1 or 2 previously uninfected
.EXE files in the current directory. Execution of some
infected programs may result in a system hang.
SVir-A: The original "virus" from Poland in early 1990 which did
SVir-B: A variant isolated in August, 1990 which has the bug in
SVir-A fixed so that it will now replicate.