USSR 948 Virus

Virus Name: USSR 948 Aliases: USSR-948, V948, 948 V Status: Rare Discovered: December, 1990 Symptoms: .COM & .EXE growth; decrease in total system and available memory Origin: USSR Eff Length: 948 Bytes Type Code: PRhA - Parasitic Resident .COM & .EXE Infector Detection Method: ViruScan, AVTK, F-Prot, NAV, Sweep, IBMAV, NAVDX, VAlert, PCScan, ChAV, NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N Removal Instructions: Delete infected files General Comments: The USSR 948 virus was received in December, 1990, and originated in the USSR. This virus is a memory resident infector of .COM and .EXE files, and will also infect COMMAND.COM. When the first program infected with USSR 948 is executed, this virus will install itself memory resident at the top of system memory but below the 640K DOS boundary. The interrupt 12 return will not be altered, although the memory in use by the virus is reserved. Interrupts 1C and 21 will be hooked by the virus. After USSR 948 is memory resident, and .COM or .EXE program which is executed or opened for any reason will become infected by the virus. Infected programs, with the exception of COMMAND.COM, will increase in size by between 950 to 963 bytes. In the case of COMMAND.COM, the virus will overwrite a portion of the stack space located in the file, so the file will not have a length change. In all cases, the file date and times in the disk directory are not altered. Infected programs will have the virus located at the end of the file. It is unknown if USSR 948 does anything besides replicate.