USSR Virus

Virus Name: USSR Aliases: V Status: Rare Discovered: October, 1990 Symptoms: .EXE growth; hard disk boot sector and master boot sector damage; system hangs; long program load times Origin: USSR Eff Length: 576 Bytes Type Code: PNE - Parasitic Non-Resident .EXE Infector Detection Method: ViruScan, F-Prot, Sweep, AVTK, PCScan, IBMAV, NAV, NAVDX, VAlert, ChAV, LProt, NShld, Sweep/N, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N Removal Instructions: Delete infected Files General Comments: The USSR virus was discovered in October, 1990 in the USSR. It is an encrypted, non-resident generic infector of .EXE files. Each time a program infected with the USSR virus is executed, it will search the current directory for the first uninfected .EXE file. If it finds one, it will attempt to infect it. Sometimes when the virus attempts to infect a file, it will hang the system leaving the drive light on, however most of the time the virus is successful. Infected files will increase in length by 576 to 586 bytes, with the virus located at the end of the file. Systems infected with this virus may go to boot their system from its hard disk only to find that the hard disk's boot sector has been removed, and the master boot sector (partition table) has been damaged, thus rendering the hard disk inaccessible. This damage can be repaired using Norton Disk Doctor, or MDisk with the /P option. Infected systems will also experience longer than normal load times when infected programs are executed. The longer than normal load time is due to the virus searching for a file to infect, and then infecting the candidate file if one was found.