QP3 Virus

Virus Name: QP3 Aliases: 1028, Dark Avenger 1028 V Status: Rare Discovery: August, 1991 Symptoms: .COM & .EXE growth; system slowdown Origin: Unknown Eff Length: 1,028 - 1,042 Bytes Type Code: PRhAK - Parasitic Resident .COM & .EXE Infector Detection Method: ViruScan, F-Prot, Sweep, AVTK, IBMAV, NAV, NAVDX, VAlert, PCScan, ChAV, NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N Removal Instructions: Delete infected files General Comments: The QP3 virus was received in August, 1991. Its origin or original point of isolation is unknown. QP3 is a memory resident infector of .COM and .EXE files, including COMMAND.COM. It is based on the Dark Avenger virus. The first time a program infected with QP3 is executed, QP3 will install itself memory resident at the top of system memory, but below the 640K DOS boundary. Total system and available free memory, as measured by the DOS CHKDSK program, will decrease by 1,104 bytes. Interrupts 1C and 21 will be hooked by the virus. Once memory resident, QP3 will infect .COM and .EXE programs when they are executed. If COMMAND.COM is executed, it will become infected. Unlike Dark Avenger, it does not infect programs when they are opened. Infected .COM files increase in size by 1,028 bytes. Infected .EXE programs increase in size by 1,031 to 1,042 bytes. In both cases, there will be no change to the file date/time in the disk directory. The virus will be located at the end of the infected file. The QP3 virus code contains one text string which can be viewed in infected programs: "QP3". It is unknown what QP3 does besides replicate. See: Dark Avenger