USSR 1014 Virus


 Virus Name:  USSR 1014 
 Aliases:     1014 
 V Status:    Rare 
 Discovered:  August, 1992 
 Symptoms:    .COM & .EXE growth; decrease in total system & available free 
              memory 
 Origin:      USSR 
 Eff Length:  1,014 - 1,028 Bytes 
 Type Code:   PRhA - Parasitic Resident .COM & .EXE Infector 
 Detection Method:  Sweep, F-Prot, IBMAV, VAlert, ViruScan, AVTK, 
                    NAV, NAVDX, PCScan, ChAV, 
                    IBMAV/N, Sweep/N, Innoc, NAV/N, AVTK/N, NProt, LProt, 
                    NShld 
 Removal Instructions:  Delete infected files 
 
 General Comments: 
       The USSR 1014, or 1014, virus was submitted in August, 1992.  It is 
       originally from the USSR.  USSR 1014 is a memory resident infector 
       of .COM and .EXE programs, including COMMAND.COM.  It does not 
       infect programs smaller than approximately 16K. 
 
       The first time a program infected with the USSR 1014 virus is 
       executed, this virus will install itself memory resident at the top 
       of system memory but below the 640K DOS boundary.  Total system and 
       available free memory, as indicated by the DOS CHKDSK program, will 
       have decreased by 1,040 bytes.  Interrupts 10, 21, and 60 will be 
       hooked by USSR 1014. 
 
       Once memory resident, the USSR 1014 virus will infect .COM and .EXE 
       programs when they are executed.  Infected programs will have a file 
       length increase of 1,014 to 1,028 bytes with the virus being located 
       at the end of the file.  The program's date and time in the DOS disk 
       directory listing will not be altered.  No text strings are visible 
       within the viral code. 
 
       The USSR 1014 virus will also alter .COM programs smaller than 16K 
       in size, adding 2 to 30 bytes to the file.  These files are not 
       infected, and will continue to function properly. 

Show viruses from discovered during that infect .

Main Page