USSR 311 Virus

 Virus Name:  USSR 311 
 Aliases:     V-311, USSR-311, Com2Con 
 V Status:    Rare 
 Discovered:  January, 1991 
 Symptoms:    .COM growth; COMMAND.COM renamed to COMMAND.CON 
 Origin:      USSR 
 Eff Length:  311 Bytes 
 Type Code:   PNCK - Parasitic Non-Resident .COM Infector 
 Detection Method:  ViruScan, F-Prot, Sweep, AVTK, IBMAV, 
                    NAV, NAVDX, VAlert, PCScan, ChAV, 
                    NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, 
                    NAV/N, IBMAV/N 
 Removal Instructions:  Delete infected files 
 General Comments: 
       The USSR 311, or V-311, virus was submitted in January, 1991.  It 
       originated in the USSR.  This virus is a non-resident infector of 
       .COM programs, including COMMAND.COM. 
       When a program infected with USSR 311 is executed, the virus will 
       check the system time to see if the seconds value is equal to one 
       of 16 values.  If it was equal to one of those 16 values, 
       COMMAND.COM will be renamed to COMMAND.CON.  Whether or not the 
       rename of COMMAND.COM occurred, the virus will then infect one 
       .COM program in the current directory. 
       Infected .COM programs will increase in length by 311 bytes, the 
       virus will be located at the end of the infected file.  The file's 
       time in the disk directory will also be modified to be 11:19:32, 
       the infection marker for this virus.  The file date in the 
       directory is not altered. 
       USSR 311 will also alter the file attributes for the file in the 
       directory.  In particular, bits 8 through 15 will be reset, which 
       may produce unexpected results in environments that make use of 
       these bits. 

Show viruses from discovered during that infect .

Main Page