USSR 948 Virus
Virus Name: USSR 948
Aliases: USSR-948, V948, 948
V Status: Rare
Discovered: December, 1990
Symptoms: .COM & .EXE growth; decrease in total system and available
Eff Length: 948 Bytes
Type Code: PRhA - Parasitic Resident .COM & .EXE Infector
Detection Method: ViruScan, AVTK, F-Prot, NAV, Sweep, IBMAV,
NAVDX, VAlert, PCScan, ChAV,
NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N,
Removal Instructions: Delete infected files
The USSR 948 virus was received in December, 1990, and originated
in the USSR. This virus is a memory resident infector of .COM and
.EXE files, and will also infect COMMAND.COM.
When the first program infected with USSR 948 is executed, this
virus will install itself memory resident at the top of system
memory but below the 640K DOS boundary. The interrupt 12 return
will not be altered, although the memory in use by the virus is
reserved. Interrupts 1C and 21 will be hooked by the virus.
After USSR 948 is memory resident, and .COM or .EXE program which
is executed or opened for any reason will become infected by the
virus. Infected programs, with the exception of COMMAND.COM, will
increase in size by between 950 to 963 bytes. In the case of
COMMAND.COM, the virus will overwrite a portion of the stack space
located in the file, so the file will not have a length change. In
all cases, the file date and times in the disk directory are not
altered. Infected programs will have the virus located at the end
of the file.
It is unknown if USSR 948 does anything besides replicate.