USSR 600 Virus

Virus Name: USSR 600 Aliases: USSR-600, V600, 600 V Status: Rare Discovered: December, 1990 Symptoms: .COM file growth Origin: USSR Eff Length: 600 Bytes Type Code: PRhCK - Parasitic Resident .COM Infector Detection Method: ViruScan, AVTK, F-Prot, NAV, Sweep, IBMAV, NAVDX, VAlert, PCScan, ChAV, NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N Removal Instructions: Delete infected files General Comments: The USSR 600 virus was submitted in December, 1990, and is from the USSR. This virus is a memory resident infector of .COM programs, including COMMAND.COM. When the first program infected with USSR 600 is executed, the virus will install itself memory resident at the top of system memory but below the 640K DOS boundary. The DOS CHKDSK program will indicate that total system memory and available free memory are 2,048 bytes less than expected. This virus does not move the interrupt 12 return. USSR 600 uses interrupts 21 and 24. Once USSR 600 is memory resident, it will infect .COM programs which are executed if they have an original file length of at least 600 bytes. Infected files will increase in size by 600 bytes, and the virus's code will be located at the beginning of the infected program. It is unknown if this virus does anything besides replicate.