USSR 492 Virus

 Virus Name:  USSR 492 
 Aliases:     USSR-492, RC492, 492 
 V Status:    Rare 
 Discovered:  December, 1990 
 Symptoms:    .COM file growth; file date/time changes 
 Origin:      USSR 
 Eff Length:  495 - 508 Bytes 
 Type Code:   PRfCK - Parasitic Resident .COM Infector 
 Detection Method:  ViruScan, AVTK, F-Prot, NAV, Sweep, IBMAV, 
                    NAVDX, VAlert, PCScan, ChAV, 
                    NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, 
                    NAV/N, IBMAV/N 
 Removal Instructions:  Delete infected files 
 General Comments: 
       The USSR 492 virus was submitted in December, 1990 and is from the 
       USSR.  This virus is a memory resident .COM file infector, it will 
       infect COMMAND.COM. 
       When the first program infected with USSR 492 is executed, the 
       virus will install itself memory resident in high system memory, 
       but below the 640K DOS boundary.  This memory is not reserved by 
       the virus. Interrupt 21 will be hooked by the virus.  At the time 
       of going memory resident, the virus will check to determine if 
       COMMAND.COM on the C: drive is infected, if it isn't, then the 
       virus will infect it. 
       Once USSR 492 is memory resident, it will infect any .COM program 
       which is executed.  Execution of COMMAND.COM on the A: drive is the 
       only way to infect COMMAND.COM on A:. 
       Programs infected with USSR 492 will have a file length increase of 
       495 to 508 bytes.  The virus will be located at the end of infected 
       programs.  Infected programs will also have their date and time in 
       the disk directory changed to the system date and time when 
       infection occurred. 
       USSR 492 does not appear to do anything besides replicate. 

Show viruses from discovered during that infect .

Main Page