R-11 Virus

Virus Name: R-11 Aliases: DataRape-11, Rape-11 V Status: Rare Discovery: August, 1991 Symptoms: .COM file growth; file allocation errors; decrease in available free memory Origin: Canada Eff Length: 747 Bytes Type Code: PRhCK - Parasitic Resident .COM Infector Detection Method: ViruScan, F-Prot, Sweep, AVTK, PCScan, NAV, IBMAV, NAVDX, VAlert, ChAV, NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N Removal Instructions: Delete infected files General Comments: The R-11 virus was received in August, 1991 from sources in both the United States and Europe. At least in the case of the United States submission, the virus was found in the public domain. R-11 is a memory resident infector of .COM files, including COMMAND.COM. The first time a program infected with R-11 is executed, R-11 will install itself memory resident at the top of system memory but below the 640K DOS boundary. Total system memory will remain unchanged, but available free memory will decrease by 848 bytes. Interrupts 21 and 69 will be hooked by the virus. Once memory resident, R-11 will infect .COM programs when they are executed. If COMMAND.COM is executed, it will become infected. R-11 infected files will increase in size by 747 bytes, with the virus being located at the end of the infected program. R-11 hides the file length increase of infected files when the virus is resident in memory. If the DOS CHKDSK program is executed with R-11 memory resident, it will indicate a file allocation error on each infected file. The DOS CHKDSK program may also get an "Invalid drive specification" error when executed with R-11 resident. R-11, on a random basis, may overwrite sectors on the system hard disk. It appears to be a later version of the R-10 virus. See: R-10