PS-MPC (ARCV-1)

Alias:
Strain:-
detected when:
where:
Classification:COM and EXE infector
Length:826

Preconditions

Operating System(s):MS-DOS
Version/Release:All models
Computer model(s):PC's
Caroname:PS-MPC (ARCV-1)

Attributes

Easy identification:

Type of Infection:

The virus appends itself to the files Selfrec on disk: (EXE) initial_SP == 4157h,(COM) File[1] == (word) Filesize-virussize-3

Infection Technique:
Infection Trigger:search current directory then successive parent directories(first for *.exe then for *.com, including system and hidden files) &&COM_filename[5] != "ND" && (Virussize <= COM_filesize <= 0FC08h)
Storage Media affected:
Interrupts hooked:24
Stealth:
Tunneling/Selfprot:
Oligo/Polymorphism:-
Encoding Method:
Damage:Transient: write MSG_DISPLAYED: to the screen and hang. Permanent: -
Damage Trigger:Transient: Month == June || Day_of_Month == 15 || Year >= 1993 Permanent: -
Particularities:The virus is not memory resident. Displayed text: "Long Live The ARCV. MUFC for the League!(c) Apache Warrior, ARCV Pres. 92Welcome to the REAL World. And the ARCV 1 Virus!"; Encrypted Not displayed text: "[ARCV-1]", "Apache Warrior, ARCV Pres."; Encrypted The encryption key is prevented from having a value of 0.The infection routine is designed to be easy to change the numberof files that are infected when the virus is run, it is set to 1in this version.
Similarities:

Agents

Countermeasures:
Standard means:

Acknowledgements

Location:Virus Test Center, University Hamburg, FRG
Classification by:Adam David, Frisk Software International
Documentation by:Adam David, Frisk Software International
Date:22.7.93
Information Source:Caroentry (autom.converter by S.Freitag)

(c) 1996 Virus-Test-Center, University of Hamburg