Virus Name: 1008
Aliases: Suomi, Oulu
V Status: Rare
Discovery: June, 1990
Symptoms: COMMAND.COM growth; internal stack errors; system halt on
Origin: Helsinki, Finland
Eff Length: 1,008 Bytes
Type Code: PRCK - Parasitic Resident COM Infector
Detection Method: ViruScan, F-Prot, NAV, AVTK, Sweep, IBMAV,
NAVDX, VAlert, PCScan, ChAV,
NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N,
Removal Instructions: F-Prot, NAV, or delete infected files
The 1008 virus was discovered in June, 1990 by Petteri Jarvinen of
Helsinki, Finland. It is a memory resident .COM infector, and will
infect COMMAND.COM. This virus is also sometimes referred to as
the Suomi virus.
The first time a program infected with the 1008 virus is executed,
the virus will install itself memory resident. COMMAND.COM is also
infected at this time, resulting in its length increasing by 1,008
Bytes. The increase in file size of COMMAND.COM cannot be seen by
doing a directory listing if the virus is present in memory.
Booting a system with an infected copy of COMMAND.COM may result
in an internal stack error, and the system being halted. This
effect was noted on the author's test machine which is a 640K
XT-clone running Microsoft MS-DOS Version 3.30.
After the virus is memory resident, it will infect any .COM file
which is executed, adding 1,008 bytes to the file length. The file
length increase cannot be seen by doing a directory listing if the
virus is present in memory.