QP3 Virus

 Virus Name:  QP3 
 Aliases:     1028, Dark Avenger 1028 
 V Status:    Rare 
 Discovery:   August, 1991 
 Symptoms:    .COM & .EXE growth; system slowdown 
 Origin:      Unknown 
 Eff Length:  1,028 - 1,042 Bytes 
 Type Code:   PRhAK - Parasitic Resident .COM & .EXE Infector 
 Detection Method:  ViruScan, F-Prot, Sweep, AVTK, IBMAV, NAV, 
                    NAVDX, VAlert, PCScan, ChAV, 
                    NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, 
                    NAV/N, IBMAV/N 
 Removal Instructions:  Delete infected files 
 General Comments: 
       The QP3 virus was received in August, 1991.  Its origin or original 
       point of isolation is unknown.  QP3 is a memory resident infector of 
       .COM and .EXE files, including COMMAND.COM.  It is based on the 
       Dark Avenger virus. 
       The first time a program infected with QP3 is executed, QP3 will 
       install itself memory resident at the top of system memory, but 
       below the 640K DOS boundary.  Total system and available free memory, 
       as measured by the DOS CHKDSK program, will decrease by 1,104 bytes. 
       Interrupts 1C and 21 will be hooked by the virus. 
       Once memory resident, QP3 will infect .COM and .EXE programs when 
       they are executed.  If COMMAND.COM is executed, it will become 
       infected.  Unlike Dark Avenger, it does not infect programs when 
       they are opened. 
       Infected .COM files increase in size by 1,028 bytes.  Infected .EXE 
       programs increase in size by 1,031 to 1,042 bytes.  In both cases, 
       there will be no change to the file date/time in the disk directory. 
       The virus will be located at the end of the infected file. 
       The QP3 virus code contains one text string which can be viewed in 
       infected programs: "QP3". 
       It is unknown what QP3 does besides replicate. 
       See:   Dark Avenger 

Show viruses from discovered during that infect .

Main Page