V388 Virus

Virus Name: V388 Aliases: V-388 V Status: New Discovered: February, 1993 Symptoms: .COM file growth; decrease in total system & available free memory; system hangs Origin: USSR Eff Length: 388 - 403 Bytes Type Code: PRhCK - Parasitic Resident .COM Infector Detection Method: Sweep, AVTK, F-Prot, ViruScan, IBMAV, PCScan, NAV, NAVDX, VAlert, ChAV, Sweep/N, NShld, AVTK/N, NAV/N, NProt, IBMAV/N, Innoc, LProt Removal Instructions: Delete infected files General Comments: The V388, or V-388, virus was submitted in February, 1993, and is from the USSR. V388 is a memory resident infector of .COM programs, including COMMAND.COM. It is not likely to become a serious threat in its present form. When the first V388 infected program is executed, the V388 virus will install itself memory resident at the top of system memory but below the 640K DOS boundary, hooking interrupt 21. Total system and available free memory, as indicated by the DOS CHKDSK program, will have decreased by 102,400 bytes. Interrupt 12's return will not have been moved. Once the V388 virus is memory resident, it will infect .COM programs when they are executed. Infected programs will have a file length increase of 394 to 403 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory listing will not be altered. No text strings are visible within the viral code in V388 infected programs. Systems infected with the V388 virus will experience frequent system hangs when programs are executed with the virus memory resident.