Virus Name: 408
V Status: Rare
Discovery: October, 1991
Symptoms: .COM file growth; unexpected error messages; write protect
errors on write protected diskettes
Eff Length: 408 Bytes
Type Code: PRfCK - Parasitic Resident .COM Infector
Detection Method: [Not In Certification Set]
Removal Instructions: Delete infected files
The 408 virus was submitted in October, 1991. 408 is a memory
resident infector of .COM files, including COMMAND.COM.
The first time a program infected with 408 is executed, this virus
will install itself memory resident in low available system memory.
There will be no change in total system or available free memory
as indicated by the DOS CHKDSK program. Interrupts 80, 82, 83, 85,
88, 89, 8A, 8C, 8E, 91, 93, 95, 96, 98, 9C, 9E, A0, A1, A2, A3, A5,
A7, A8, AA, AC, AF, B4, B8, and BB will all be hooked by the virus
in available free memory.
Once 408 is memory resident, it will infect any .COM program,
including COMMAND.COM, when they are executed. Infected .COM
programs will increase in size by 408 bytes with the virus being
located at the end of the infected file. There will be no visible
change in the file's date and time in the DOS disk directory
Systems infected with 408 will experience write protect errors when
attempting to execute programs from write-protected diskettes.
Additionally, some programs which require command line input will
receive error messages as though the command line input was not
408 does not appear to do anything besides replicate.