Virus Name: QP3
Aliases: 1028, Dark Avenger 1028
V Status: Rare
Discovery: August, 1991
Symptoms: .COM & .EXE growth; system slowdown
Eff Length: 1,028 - 1,042 Bytes
Type Code: PRhAK - Parasitic Resident .COM & .EXE Infector
Detection Method: ViruScan, F-Prot, Sweep, AVTK, IBMAV, NAV,
NAVDX, VAlert, PCScan, ChAV,
NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N,
Removal Instructions: Delete infected files
The QP3 virus was received in August, 1991. Its origin or original
point of isolation is unknown. QP3 is a memory resident infector of
.COM and .EXE files, including COMMAND.COM. It is based on the
Dark Avenger virus.
The first time a program infected with QP3 is executed, QP3 will
install itself memory resident at the top of system memory, but
below the 640K DOS boundary. Total system and available free memory,
as measured by the DOS CHKDSK program, will decrease by 1,104 bytes.
Interrupts 1C and 21 will be hooked by the virus.
Once memory resident, QP3 will infect .COM and .EXE programs when
they are executed. If COMMAND.COM is executed, it will become
infected. Unlike Dark Avenger, it does not infect programs when
they are opened.
Infected .COM files increase in size by 1,028 bytes. Infected .EXE
programs increase in size by 1,031 to 1,042 bytes. In both cases,
there will be no change to the file date/time in the disk directory.
The virus will be located at the end of the infected file.
The QP3 virus code contains one text string which can be viewed in
infected programs: "QP3".
It is unknown what QP3 does besides replicate.
See: Dark Avenger