USSR 1014 Virus
Virus Name: USSR 1014
V Status: Rare
Discovered: August, 1992
Symptoms: .COM & .EXE growth; decrease in total system & available free
Eff Length: 1,014 - 1,028 Bytes
Type Code: PRhA - Parasitic Resident .COM & .EXE Infector
Detection Method: Sweep, F-Prot, IBMAV, VAlert, ViruScan, AVTK,
NAV, NAVDX, PCScan, ChAV,
IBMAV/N, Sweep/N, Innoc, NAV/N, AVTK/N, NProt, LProt,
Removal Instructions: Delete infected files
The USSR 1014, or 1014, virus was submitted in August, 1992. It is
originally from the USSR. USSR 1014 is a memory resident infector
of .COM and .EXE programs, including COMMAND.COM. It does not
infect programs smaller than approximately 16K.
The first time a program infected with the USSR 1014 virus is
executed, this virus will install itself memory resident at the top
of system memory but below the 640K DOS boundary. Total system and
available free memory, as indicated by the DOS CHKDSK program, will
have decreased by 1,040 bytes. Interrupts 10, 21, and 60 will be
hooked by USSR 1014.
Once memory resident, the USSR 1014 virus will infect .COM and .EXE
programs when they are executed. Infected programs will have a file
length increase of 1,014 to 1,028 bytes with the virus being located
at the end of the file. The program's date and time in the DOS disk
directory listing will not be altered. No text strings are visible
within the viral code.
The USSR 1014 virus will also alter .COM programs smaller than 16K
in size, adding 2 to 30 bytes to the file. These files are not
infected, and will continue to function properly.