Virus Name: AVV-2300
Aliases: AVV 1.12
V Status: Rare
Discovery: November, 1993
Symptoms: .COM file growth; messages
Eff Length: 2,300 Bytes
Type Code: PNCK - Parasitic Non-Resident .COM Infector
Detection Method: F-Prot, ViruScan, IBMAV, AVTK, Sweep, ChAV,
NAV, NAVDX, VAlert, PCScan,
NShld, Sweep/N, AVTK/N, NProt, IBMAV/N, Innoc, NAV/N,
Removal Instructions: Delete infected files
The AVV-2300 or AVV 1.12 virus was received in November, 1993. Its
origin or point of isolation is unknown. AVV-2300 is a non-resident
infector of .COM programs, including COMMAND.COM. It does not
infect very small .COM programs.
When a program infected with the AVV-2300 virus is executed, this
virus will infect one .COM program located in the current directory.
Infected programs will have a file length increase of 2,300 bytes with
the virus being located at the beginning of the file. The file's date
and time in the DOS disk directory listing will not be altered. The
following text strings are visible within the viral code in all
AVV-2300 infected programs:
"The AVV version 1.12, Copyright (C) 1992"
"*.com AVV Warning!"
"In file filename.ext may be virus."
"In system area may be virus."
"In system may be virus."
"The AntiVirus Virus version 1.12:
I am checking 200++ viruses"
"Thank's Yankee Doodle for original vectors"
As implied by the above messages, this virus is capable of detecting
the presence of many older viruses in system memory, as well as
system and program files. It also contains code to remove itself
from infected programs if the AVV environmental variable is set to