408 Virus

Virus Name: 408 Aliases: V Status: Rare Discovery: October, 1991 Symptoms: .COM file growth; unexpected error messages; write protect errors on write protected diskettes Origin: Unknown Eff Length: 408 Bytes Type Code: PRfCK - Parasitic Resident .COM Infector Detection Method: [Not In Certification Set] Removal Instructions: Delete infected files General Comments: The 408 virus was submitted in October, 1991. 408 is a memory resident infector of .COM files, including COMMAND.COM. The first time a program infected with 408 is executed, this virus will install itself memory resident in low available system memory. There will be no change in total system or available free memory as indicated by the DOS CHKDSK program. Interrupts 80, 82, 83, 85, 88, 89, 8A, 8C, 8E, 91, 93, 95, 96, 98, 9C, 9E, A0, A1, A2, A3, A5, A7, A8, AA, AC, AF, B4, B8, and BB will all be hooked by the virus in available free memory. Once 408 is memory resident, it will infect any .COM program, including COMMAND.COM, when they are executed. Infected .COM programs will increase in size by 408 bytes with the virus being located at the end of the infected file. There will be no visible change in the file's date and time in the DOS disk directory display. Systems infected with 408 will experience write protect errors when attempting to execute programs from write-protected diskettes. Additionally, some programs which require command line input will receive error messages as though the command line input was not received. 408 does not appear to do anything besides replicate.