What is the 386 file format?
.386 files are Virtual Device Drivers (VxDs) for Windows 386 Enhanced Mode, introduced with Windows/386 2.x in 1988. A VxD is a kernel-mode binary component that virtualizes a hardware device or OS service - such as a timer, keyboard, display adapter, or disk controller - so that multiple DOS applications running simultaneously can each believe they have exclusive access to the hardware.
Internally, a .386 file is an MZ DOS executable stub followed by a Linear Executable (LE) header. The LE header carries a VxD descriptor block identifying the device ID, version, and entry points for initialization, I/O port virtualization, and interrupt handling. Windows/386 2.x used an earlier proprietary W386 header format before the LE standard was adopted.
.386 VxDs run entirely in Ring 0 (kernel mode) with no memory isolation. This made them powerful but unstable: a faulty driver could crash the entire operating system. Windows NT used the WDM (Windows Driver Model) with proper kernel isolation from the start; Windows 98 SE began the transition, and Windows Me was the last consumer release to support VxDs. Windows XP and later cannot load .386 files at all - the VxD subsystem was removed.
The same virtual device driver role is also filled by .vxd files (functionally identical, different extension used for dynamic VxDs under Windows 95/98). Well-known examples include VSHARE.386, VFAT.386, and VTDAPI.386. These files are loaded automatically by the Windows kernel at boot or on demand; they cannot and should not be opened manually.
Security & safety
RISK: MEDIUMLegitimate .386 files are Windows system drivers, harmless on modern Windows (they do not load). However, malware historically used the .386 extension on Windows 9x/Me to disguise kernel-mode payloads - on those OSes, Ring 0 VxDs could hide themselves from antivirus. On Windows XP and later, .386 files cannot load as VxDs and pose no execution risk. If antivirus flags a .386 file on a modern system, it is likely a historical detection signature or a file disguised with the .386 extension.
Format details
in a nutshell- Ventura Publisher font file - Some versions of Xerox/Corel Ventura Publisher used .386 for downloadable 386-optimised font data - rare, pre-1995.
Programs that open 386 files
Windows3 apps
Microsoft Windows (3.x / 95 / 98 / Me - kernel loads automatically)
Paid Not user-openable. Windows loads .386 VxDs automatically from SYSTEM.INI [386Enh] section or the \WINDOWS\SYSTEM folder at startup.
HxD Hex Editor (inspect only)
Free Open as binary to inspect the LE header and VxD descriptor block. Cannot execute or load the driver.
IDA Pro / Ghidra (reverse engineering)
Open-source Ghidra supports LE (Linear Executable) format for disassembling legacy VxDs. Technical details
deep spec| Encoding | Binary executable (MZ DOS stub + Linear Executable LE body) |
| Byte order | Little-endian |
| File header | MZ header (4D 5A) at offset 0 (DOS stub); LE header (4C 45) at offset pointed to by dword at 0x3C |
| Earliest format variant | Windows/386 2.x (1988): proprietary W386 header, predating the LE standard |
| Execution ring | Ring 0 (kernel mode) - VxDs run with full hardware access and no memory isolation |
| Typical file size | 2 KB - 200 KB |
| VxD descriptor block | Identifies device ID, version, and entry points: initialization, I/O port handling, interrupt virtualization |
| OS compatibility | Windows 2.x (Windows/386) through Windows Me; not loadable on Windows XP or later |
| Successor technology | WDM (Windows Driver Model) introduced in Windows 98 SE / Windows 2000; drivers use .sys extension |
| Dynamic loading | Supported from Windows for Workgroups 3.11 onward; earlier versions used static VxDs only |
| Notable examples | VSHARE.386, VFAT.386, VTDAPI.386, EMM386.386, WINA20.386 |
| Released | 1988 (Windows/386 2.x) |
| Latest version | Used through Windows Me (2000); superseded by WDM in Windows 98 SE / 2000 |
| Specification | devblogs.microsoft.com |
386 conversions
Community Q&A
asked by usersNo questions yet - be the first to ask about 386 files.
