382 Recovery Virus
Virus Name: 382 Recovery
Aliases: 382, Recovery, 382 Recovery.1
V Status: Viron
Discovery: July, 1990
Symptoms: First 382 bytes of .COM files overwritten; system hangs;
spurious characters on system display; disk drive spinning;
Eff Length: N/A
Type Code: ONAK - Overwriting Non-Resident .COM & .EXE Infector
Detection Method: ViruScan, AVTK, NAV, F-Prot, Sweep, IBMAV, NAVDX,
VAlert, PCScan, ChAV,
NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, NAV/N,
Removal Instructions: Delete infected files
The 382 Recovery virus was isolated in July 1990 in Taiwan. It is
a non-resident generic infector of .COM and .EXE files, including
Each time a program infected with the 382 Recovery virus is
executed, the virus will check the current directory for a .COM
file that has not been infected with the virus. If it finds an
uninfected .COM file, it will infect it. If the original file was
less than 382 bytes in length, the infected file will now be 382
bytes in length. Files which were originally greater than 382 bytes
in length will not show any increase in length. Infected files
always have the first 382 bytes of the file overwritten to contain
the virus's code.
Once all .COM files in the current directory are infected, the next
time an infected .COM file is executed the virus will rename all
.EXE files to .COM files. These renamed files, however, may or may
not later become infected.
Symptoms of the 382 Recovery virus being present on a file are that
the program will not execute properly. In some cases, the program
will hang upon execution, requiring the system to be rebooted. In
other cases, spurious characters will appear on the system display
and the program will not run. Lastly, the system may do nothing but
leave the disk drive spinning, requiring the system to be powered
off and rebooted.
Occasionally, the 382 Recovery virus will corrupt IO.SYS, one of
the hidden system files. Once this corruption has occurred, attempts
to boot from the infected disk will fail.
Since the first 382 bytes of infected files have been overwritten,
the infected files cannot be recovered. The original 382 bytes of
the file are permanently lost. Infected files should be deleted or
erased and replaced with backup copies known to be free of infection.
Known variant(s) of 382 Recovery are:
382 Recovery.1: A minor variant of 382 Recovery which is
functionally equivalent to the original virus. This
variant differs by only one byte.