USSR 516 Virus
Virus Name: USSR 516
Aliases: Leapfrog, V516, 516
V Status: Rare
Discovered: December, 1990
Symptoms: .COM file growth
Eff Length: 516 Bytes
Type Code: PRCK - Parasitic Resident .COM Infector
Detection Method: ViruScan, AVTK, F-Prot, NAV, Sweep, IBMAV,
NAVDX, VAlert, PCScan, ChAV,
NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N,
Removal Instructions: Delete infected files
The USSR 516 virus was submitted in December, 1990. It is from the
USSR. This virus is a memory resident infector of .COM programs,
including COMMAND.COM. It infects on file execution.
The first time a program infected with the USSR 516 virus is
executed, the virus will install itself memory resident in a "hole
in memory" between MSDOS and the DOS Stacks. This area will be
labeled DOS Data. Interrupt 21 will be hooked by the virus. There
will be no change in total system memory or available free memory.
After the virus is memory resident, it will infect .COM programs
which are executed that had an uninfected file length which was
greater than 512 bytes. Infected .COM programs will have their
length increased by 516 bytes, the virus will be located at the end
of the program.
USSR 516 does not appear to do anything besides replicate. The
original submitted sample was not a natural infection of this
virus, so this may be a research virus.