Ontario.1024 (computer virus)

From Wikipedia, the free encyclopedia

Ontario.1024
Common name Ontario.1024
Technical name Ontario.1024
Aliases 1024 SBC
Family Ontario
Classification Virus
  Type DOS
  Subtype DOS file infector
Isolation October 1991
  Point of Isolation Ontario, Canada
  Point of Origin Ontario, Canada
Author(s) Death Angel
This box: view  talk  edit

Ontario.1024 is a computer virus, discovered in October 1991, over a year after the isolation of the first Ontario virus, Ontario.512. Relative to Ontario.512, most additions involve making the virus harder to detect.

Contents

[edit] Infection

Ontario.1024 is an encrypting, stealth DOS file infector. Upon the execution of an infected .COM or .EXE file, Ontario.1024 goes memory resident and infects files of these times upon being opened. COMMAND.COM is infected using a special routine. Infected files will increase in size by 1,024 bytes. However, when Ontario.1024 is in memory, no increase in file size will be observed due to the virus' stealthing. Unlike Ontario.512, it will not infect .OVL files.

[edit] Symptoms

Ontario.1024 is the least readily identified version of the Ontario family. The following symptoms can be observed:

  • An increase in size of infected COM and EXE files of 1,024 bytes.
  • A decrease in available system memory of 3,072 bytes.
  • File size being changed after executables (infected ones) are executed, to display original file size.
  • Occasional printer-related problems.

The first three symptoms are good indications that a virus is present, but are not necessarily specific to Ontario.1024.

[edit] Prevalence

The WildList[1], an organisation tracking computer viruses, listed Ontario.1024 as being in the field from July 1993 to December 1998, when it was removed due to lack of a submitted sample. These reports indicated that Ontario.1024 had spread as widely as Australia and Israel at its peak in 1994-1995.

Like all DOS file infectors, the advent of Windows significantly hindered the spread of Ontario.1024. Trend Micro[2] reports 301 infections since 6 November 2000, with rates having fallen to about once every month or two by 2005.

[edit] External links