R-11 Virus

 Virus Name:  R-11 
 Aliases:     DataRape-11, Rape-11 
 V Status:    Rare 
 Discovery:   August, 1991 
 Symptoms:    .COM file growth; file allocation errors; decrease in 
              available free memory 
 Origin:      Canada 
 Eff Length:  747 Bytes 
 Type Code:   PRhCK - Parasitic Resident .COM Infector 
 Detection Method:  ViruScan, F-Prot, Sweep, AVTK, PCScan, 
                    NAV, IBMAV, NAVDX, VAlert, ChAV, 
                    NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, NAV/N, 
 Removal Instructions:  Delete infected files 
 General Comments: 
       The R-11 virus was received in August, 1991 from sources in both 
       the United States and Europe.  At least in the case of the United 
       States submission, the virus was found in the public domain.  R-11 
       is a memory resident infector of .COM files, including COMMAND.COM. 
       The first time a program infected with R-11 is executed, R-11 
       will install itself memory resident at the top of system memory but 
       below the 640K DOS boundary.  Total system memory will remain 
       unchanged, but available free memory will decrease by 848 bytes. 
       Interrupts 21 and 69 will be hooked by the virus. 
       Once memory resident, R-11 will infect .COM programs when they are 
       executed.  If COMMAND.COM is executed, it will become infected. 
       R-11 infected files will increase in size by 747 bytes, with the 
       virus being located at the end of the infected program. 
       R-11 hides the file length increase of infected files when the 
       virus is resident in memory.  If the DOS CHKDSK program is 
       executed with R-11 memory resident, it will indicate a file 
       allocation error on each infected file.  The DOS CHKDSK program 
       may also get an "Invalid drive specification" error when executed 
       with R-11 resident. 
       R-11, on a random basis, may overwrite sectors on the system hard 
       disk.  It appears to be a later version of the R-10 virus. 
       See:   R-10 

Show viruses from discovered during that infect .

Main Page