USSR 948 Virus

 Virus Name:  USSR 948 
 Aliases:     USSR-948, V948, 948 
 V Status:    Rare 
 Discovered:  December, 1990 
 Symptoms:    .COM & .EXE growth; decrease in total system and available 
 Origin:      USSR 
 Eff Length:  948 Bytes 
 Type Code:   PRhA - Parasitic Resident .COM & .EXE Infector 
 Detection Method:  ViruScan, AVTK, F-Prot, NAV, Sweep, IBMAV, 
                    NAVDX, VAlert, PCScan, ChAV, 
                    NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, 
                    NAV/N, IBMAV/N 
 Removal Instructions:  Delete infected files 
 General Comments: 
       The USSR 948 virus was received in December, 1990, and originated 
       in the USSR.  This virus is a memory resident infector of .COM and 
       .EXE files, and will also infect COMMAND.COM. 
       When the first program infected with USSR 948 is executed, this 
       virus will install itself memory resident at the top of system 
       memory but below the 640K DOS boundary.  The interrupt 12 return 
       will not be altered, although the memory in use by the virus is 
       reserved. Interrupts 1C and 21 will be hooked by the virus. 
       After USSR 948 is memory resident, and .COM or .EXE program which 
       is executed or opened for any reason will become infected by the 
       virus. Infected programs, with the exception of COMMAND.COM, will 
       increase in size by between 950 to 963 bytes.  In the case of 
       COMMAND.COM, the virus will overwrite a portion of the stack space 
       located in the file, so the file will not have a length change.  In 
       all cases, the file date and times in the disk directory are not 
       altered.  Infected programs will have the virus located at the end 
       of the file. 
       It is unknown if USSR 948 does anything besides replicate. 

Show viruses from discovered during that infect .

Main Page