Virus Name: R-11
Aliases: DataRape-11, Rape-11
V Status: Rare
Discovery: August, 1991
Symptoms: .COM file growth; file allocation errors; decrease in
available free memory
Eff Length: 747 Bytes
Type Code: PRhCK - Parasitic Resident .COM Infector
Detection Method: ViruScan, F-Prot, Sweep, AVTK, PCScan,
NAV, IBMAV, NAVDX, VAlert, ChAV,
NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, NAV/N,
Removal Instructions: Delete infected files
The R-11 virus was received in August, 1991 from sources in both
the United States and Europe. At least in the case of the United
States submission, the virus was found in the public domain. R-11
is a memory resident infector of .COM files, including COMMAND.COM.
The first time a program infected with R-11 is executed, R-11
will install itself memory resident at the top of system memory but
below the 640K DOS boundary. Total system memory will remain
unchanged, but available free memory will decrease by 848 bytes.
Interrupts 21 and 69 will be hooked by the virus.
Once memory resident, R-11 will infect .COM programs when they are
executed. If COMMAND.COM is executed, it will become infected.
R-11 infected files will increase in size by 747 bytes, with the
virus being located at the end of the infected program.
R-11 hides the file length increase of infected files when the
virus is resident in memory. If the DOS CHKDSK program is
executed with R-11 memory resident, it will indicate a file
allocation error on each infected file. The DOS CHKDSK program
may also get an "Invalid drive specification" error when executed
with R-11 resident.
R-11, on a random basis, may overwrite sectors on the system hard
disk. It appears to be a later version of the R-10 virus.