RTL4 Virus

Virus Name: RTL4 Aliases: V Status: Rare Discovery: December, 1992 Symptoms: .COM file growth; message; system hangs Origin: The Netherlands Eff Length: 503 Bytes Type Code: PNCK - Parasitic Non-Resident .COM Infector Detection Method: ViruScan, Sweep, AVTK, F-Prot, IBMAV, PCScan, NAV, NAVDX, VAlert, ChAV, NShld, Sweep/N, AVTK/N, LProt, NAV/N, NProt, IBMAV/N, Innoc Removal Instructions: Delete infected files General Comments: The RTL4 virus was submitted in December, 1992, and is from The Netherlands. RTL4 is a non-resident, direct action infector of .COM programs, including COMMAND.COM. When a program infected with the RTL4 virus is executed, the RTL4 virus will infect one .COM program located in the current directory, along with displaying the following message: "RTL4" "Joop van den Ende Produkties BV Marco Daas (Casting Assistent) Postbus 397 1430 AJ AALSMEER van Cleeffkade 15 1413 BA AALSMEER The Netherlands Wedden dat... je een virus hebt?" A system hang will then occur. The above text is encrypted within infected files, so it is not visible. Programs infected with the RTL4 virus will have a file length increase of 503 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory listing will not be altered. In addition to the above text, the following text string is also encrypted within infected files: "*.COM" The individual and the addresses indicated above are displayed by the virus, but should not be construed to indicate that this individual wrote the virus.