RIP-699 Virus

 Virus Name:  RIP-699 
 Aliases:     RIP, Patsy 
 V Status:    Rare 
 Discovery:   January, 1993 
 Symptoms:    .COM file growth; TSR; message 
 Origin:      Australia 
 Eff Length:  699 Bytes 
 Type Code:   PRsCK - Parasitic Resident .COM Infector 
 Detection Method:  ViruScan, AVTK, F-Prot, Sweep, ChAV, 
                    NAV, IBMAV, NAVDX, VAlert, PCScan, 
                    NShld, AVTK/N, Sweep/N, NAV/N, IBMAV/N, Innoc 
 Removal Instructions:  Delete infected files 
 General Comments: 
       The RIP-699, RIP, or Patsy, virus was discovered in Australia in 
       January, 1993.  It is a memory resident infector of .COM programs, 
       including COMMAND.COM.  It activates on March 6th and September 8th, 
       when it may display a message. 
       When the first RIP-699 infected program is executed, the RIP-699 
       virus will install itself memory resident as a low system memory 
       TSR of 1,792 bytes.  It hooks interupts 10 and 21.  It may appear 
       as part of Command Data in memory under some memory mapping 
       Once memory resident, RIP-699 infects .COM programs, including 
       COMMAND.COM, when they are executed.  Infected programs will have 
       a file length increase of 699 bytes with the virus being located 
       at the end of the file.  The program's date and time in the DOS 
       disk directory listing will not be altered.  The following text 
       string is encrypted within the RIP-699 viral code: 
          "RIP Patsy Cline 8th September 1932 - 6th March 1963" 
       RIP-699 activates on March 6th and September 8th of any year.  On 
       those dates, if the user executes a program to set the system 
       video mode to text mode 80 by 25 with the virus memory resident, 
       the above message will be displayed. 

Show viruses from discovered during that infect .

Main Page