Ontario 730 Virus

Virus Name: Ontario 730 Aliases: Ont-730 V Status: Rare Discovered: December, 1991 Symptoms: .COM & .EXE growth; TSR; FAT & Master Boot Sector Damage Origin: Ontario, Canada Eff Length: 730 - 744 Bytes Type Code: PRsA - Parasitic Resident .COM, .EXE, & Overlay Infector Detection Method: ViruScan, F-Prot, AVTK, NAV, Sweep, IBMAV, PCScan, NAVDX, VAlert, ChAV, NShld, Sweep/N, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N, LProt Removal Instructions: Delete infected files General Comments: The Ontario 730, or 730, virus was discovered in Ontario, Canada, in December, 1991. Ontario 730 is a memory resident infector of .COM, .EXE, and overlay files. The first time a program infected with Ontario 730 is executed, this virus will install itself memory resident as a low system memory TSR of 1,024 bytes. It will have hooked interrupt 21. Once Ontario 730 is memory resident, it will infect .COM, .EXE, and when they are executed, though this does not always occur. It does not infect COMMAND.COM. Programs infected with Ontario 730 will have a file length increase of 730 to 744 bytes. The virus will be located at the end of the infected file. The file's date and time in the DOS disk directory listing will not be altered. One text string can be found within the viral code of the Ontario 730 virus in infected files: "!=TVu" In advanced infections of the Ontario 730 virus, the file allocation table and master boot sector (partition table) may be damaged by the virus. See: Ontario