USSR 311 Virus

Virus Name: USSR 311 Aliases: V-311, USSR-311, Com2Con V Status: Rare Discovered: January, 1991 Symptoms: .COM growth; COMMAND.COM renamed to COMMAND.CON Origin: USSR Eff Length: 311 Bytes Type Code: PNCK - Parasitic Non-Resident .COM Infector Detection Method: ViruScan, F-Prot, Sweep, AVTK, IBMAV, NAV, NAVDX, VAlert, PCScan, ChAV, NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N Removal Instructions: Delete infected files General Comments: The USSR 311, or V-311, virus was submitted in January, 1991. It originated in the USSR. This virus is a non-resident infector of .COM programs, including COMMAND.COM. When a program infected with USSR 311 is executed, the virus will check the system time to see if the seconds value is equal to one of 16 values. If it was equal to one of those 16 values, COMMAND.COM will be renamed to COMMAND.CON. Whether or not the rename of COMMAND.COM occurred, the virus will then infect one .COM program in the current directory. Infected .COM programs will increase in length by 311 bytes, the virus will be located at the end of the infected file. The file's time in the disk directory will also be modified to be 11:19:32, the infection marker for this virus. The file date in the directory is not altered. USSR 311 will also alter the file attributes for the file in the directory. In particular, bits 8 through 15 will be reset, which may produce unexpected results in environments that make use of these bits.