USSR 492 Virus

Virus Name: USSR 492 Aliases: USSR-492, RC492, 492 V Status: Rare Discovered: December, 1990 Symptoms: .COM file growth; file date/time changes Origin: USSR Eff Length: 495 - 508 Bytes Type Code: PRfCK - Parasitic Resident .COM Infector Detection Method: ViruScan, AVTK, F-Prot, NAV, Sweep, IBMAV, NAVDX, VAlert, PCScan, ChAV, NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N Removal Instructions: Delete infected files General Comments: The USSR 492 virus was submitted in December, 1990 and is from the USSR. This virus is a memory resident .COM file infector, it will infect COMMAND.COM. When the first program infected with USSR 492 is executed, the virus will install itself memory resident in high system memory, but below the 640K DOS boundary. This memory is not reserved by the virus. Interrupt 21 will be hooked by the virus. At the time of going memory resident, the virus will check to determine if COMMAND.COM on the C: drive is infected, if it isn't, then the virus will infect it. Once USSR 492 is memory resident, it will infect any .COM program which is executed. Execution of COMMAND.COM on the A: drive is the only way to infect COMMAND.COM on A:. Programs infected with USSR 492 will have a file length increase of 495 to 508 bytes. The virus will be located at the end of infected programs. Infected programs will also have their date and time in the disk directory changed to the system date and time when infection occurred. USSR 492 does not appear to do anything besides replicate.