1008 Virus

Virus Name: 1008 Aliases: Suomi, Oulu V Status: Rare Discovery: June, 1990 Symptoms: COMMAND.COM growth; internal stack errors; system halt on boot Origin: Helsinki, Finland Eff Length: 1,008 Bytes Type Code: PRCK - Parasitic Resident COM Infector Detection Method: ViruScan, F-Prot, NAV, AVTK, Sweep, IBMAV, NAVDX, VAlert, PCScan, ChAV, NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N Removal Instructions: F-Prot, NAV, or delete infected files General Comments: The 1008 virus was discovered in June, 1990 by Petteri Jarvinen of Helsinki, Finland. It is a memory resident .COM infector, and will infect COMMAND.COM. This virus is also sometimes referred to as the Suomi virus. The first time a program infected with the 1008 virus is executed, the virus will install itself memory resident. COMMAND.COM is also infected at this time, resulting in its length increasing by 1,008 Bytes. The increase in file size of COMMAND.COM cannot be seen by doing a directory listing if the virus is present in memory. Booting a system with an infected copy of COMMAND.COM may result in an internal stack error, and the system being halted. This effect was noted on the author's test machine which is a 640K XT-clone running Microsoft MS-DOS Version 3.30. After the virus is memory resident, it will infect any .COM file which is executed, adding 1,008 bytes to the file length. The file length increase cannot be seen by doing a directory listing if the virus is present in memory.