V388 Virus

 Virus Name:  V388 
 Aliases:     V-388    
 V Status:    New 
 Discovered:  February, 1993 
 Symptoms:    .COM file growth; decrease in total system & available free 
              memory; system hangs 
 Origin:      USSR 
 Eff Length:  388 - 403 Bytes 
 Type Code:   PRhCK - Parasitic Resident .COM Infector 
 Detection Method:  Sweep, AVTK, F-Prot, ViruScan, IBMAV, PCScan, 
                    NAV, NAVDX, VAlert, ChAV, 
                    Sweep/N, NShld, AVTK/N, NAV/N, NProt, IBMAV/N, Innoc, 
 Removal Instructions:  Delete infected files 
 General Comments: 
       The V388, or V-388, virus was submitted in February, 1993, and is 
       from the USSR.  V388 is a memory resident infector of .COM programs, 
       including COMMAND.COM.  It is not likely to become a serious threat 
       in its present form. 
       When the first V388 infected program is executed, the V388 virus 
       will install itself memory resident at the top of system memory but 
       below the 640K DOS boundary, hooking interrupt 21.  Total system and 
       available free memory, as indicated by the DOS CHKDSK program, will 
       have decreased by 102,400 bytes.  Interrupt 12's return will not have 
       been moved. 
       Once the V388 virus is memory resident, it will infect .COM programs 
       when they are executed.  Infected programs will have a file length 
       increase of 394 to 403 bytes with the virus being located at the end 
       of the file.  The program's date and time in the DOS disk directory 
       listing will not be altered.  No text strings are visible within the 
       viral code in V388 infected programs. 
       Systems infected with the V388 virus will experience frequent system 
       hangs when programs are executed with the virus memory resident. 

Show viruses from discovered during that infect .

Main Page