Ontario (computer virus)
From Wikipedia, the free encyclopedia
| Common name | Ontario.512 |
|---|---|
| Technical name | Ontario.512 |
| Aliases | SBC |
| Family | Ontario |
| Classification | Virus |
| Type | DOS |
| Subtype | DOS file infector |
| Isolation | July 1990 |
| Point of Isolation | Hamilton (?), Ontario, Canada |
| Point of Origin | Ontario, Canada |
| Author(s) | Death Angel |
- This article refers to the 512 byte variant of the Ontario virus. For the 1,024 byte variant, see Ontario.1024 (computer virus). For the lesser-known 2,048 byte variant, see Ontario.2048 (computer virus).
Ontario.512 is a computer virus, discovered in July 1990. It is named after its point of isolation, the Canadian province of Ontario. Because Ontario.1024 was also discovered in Ontario, it is likely that both viruses originate from within the province. By the Ontario.2048 variant, the author had adopted "Ontario" as the family's name and even included the name "Ontario-3" in the virus code.
Contents |
[edit] Infection
Ontario.512 is an encrypting DOS file infector. Upon the execution of an infected .COM, .EXE or .OVL file, Ontario.512 goes memory resident and infects files of these times upon being opened. COMMAND.COM is infected using a special routine. Infected files will increase either 512 bytes (COM files) or between 512 and 1,023 bytes (EXE and OVL files). Some systems with larger file sectors may display increases of greater than 1,023 bytes for infected files of these types.
[edit] Symptoms
Ontario.512 primarily only infects files, so there is no one significant symptom. The two main symptoms are:
- An increase in size of infected COM files of 512 bytes.
- An increase in size of infected EXE and OVL files of between 512 and 1,023 bytes, and even greater on some systems.
- Systems thoroughly infected by Ontario.512 may suffer from increasing file corruption and other hard drive problems over time.
- Unspecified printer problems have been observed with the Ontario family, although most of these observations have related to Ontario.1024, not Ontario.512. It is unknown what specific problems these are, and if they affect Ontario.512.
The increase in COM file size in conjunction with EXE and OVL file increases is a very good guideline when determining Ontario.512 infection, although file length changes are common among virtually every file infector.
[edit] Prevalence
The WildList[1], an organisation tracking computer viruses, never reported Ontario.512 as being in the field. However, Ontario.1024 was included on the list for a period of time. It is unclear whether Ontario.512 was discovered in the field, or off a BBS out of Toronto, where Ontario.2048 was posted.
