RSP-1876 Virus

Virus Name: RSP-1876 Aliases: 1876 V Status: Rare Discovery: November, 1991 Symptoms: .COM & .EXE growth; beeping; random characters written to system display; system hangs Origin: Unknown Eff Length: 1,876 Bytes Type Code: PRsAK - Parasitic Resident .COM & .EXE Infector Detection Method: ViruScan, Sweep, F-Prot, PCScan, AVTK 7.68+, NAV, IBMAV, NAVDX, VAlert, ChAV, NShld, LProt, Sweep/N, Innoc, NAV/N, IBMAV/N, AVTK/N 7.68+ Removal Instructions: Delete infected files General Comments: The RSP-1876 virus was received in November, 1991. Its origin is unknown. RSP-1876 is a memory resident infector of .COM and .EXE programs, including COMMAND.COM. When the first RSP-1876 infected program is executed, this virus will install itself in low system memory similar to a TSR. The area will not appear as a TSR, however, with most memory mapping utilities. Interrupts 21 and 22 will be hooked by the virus in memory. Once RSP-1876 is memory resident, it will infect .COM and .EXE programs when they are executed. If COMMAND.COM is executed, it will also become infected. Infected programs increase in size by 1,876 bytes with the virus being located at the end of the file. The file's date and time in a DOS disk directory listing will not have been altered. The following text string can be found within the viral code in infected files: "RSP" Execution of RSP-1876 infected programs may result in beeping being emitted from the system speaker, as well as randome characters from system memory being written to the system display. System hangs may also occur.