RIP-699 Virus

Virus Name: RIP-699 Aliases: RIP, Patsy V Status: Rare Discovery: January, 1993 Symptoms: .COM file growth; TSR; message Origin: Australia Eff Length: 699 Bytes Type Code: PRsCK - Parasitic Resident .COM Infector Detection Method: ViruScan, AVTK, F-Prot, Sweep, ChAV, NAV, IBMAV, NAVDX, VAlert, PCScan, NShld, AVTK/N, Sweep/N, NAV/N, IBMAV/N, Innoc Removal Instructions: Delete infected files General Comments: The RIP-699, RIP, or Patsy, virus was discovered in Australia in January, 1993. It is a memory resident infector of .COM programs, including COMMAND.COM. It activates on March 6th and September 8th, when it may display a message. When the first RIP-699 infected program is executed, the RIP-699 virus will install itself memory resident as a low system memory TSR of 1,792 bytes. It hooks interupts 10 and 21. It may appear as part of Command Data in memory under some memory mapping utilities. Once memory resident, RIP-699 infects .COM programs, including COMMAND.COM, when they are executed. Infected programs will have a file length increase of 699 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory listing will not be altered. The following text string is encrypted within the RIP-699 viral code: "RIP Patsy Cline 8th September 1932 - 6th March 1963" RIP-699 activates on March 6th and September 8th of any year. On those dates, if the user executes a program to set the system video mode to text mode 80 by 25 with the virus memory resident, the above message will be displayed.