Virus Name: RNA
V Status: Rare
Discovery: March, 1992
Symptoms: .COM & .EXE growth; zero byte files created; system hangs
Eff Length: 7,296 Bytes
Type Code: PNA - Parasitic Non-Resident .COM & .EXE Infector
Detection Method: ViruScan, AVTK, F-Prot, Sweep, NAV,
IBMAV, NAVDX, VAlert, PCScan, ChAV,
NShld, Sweep/N, Innoc, AVTK/N, NAV/N, NProt, IBMAV/N,
Removal Instructions: Delete infected files
The RNA virus was submitted in March, 1992. Its origin is
unknown. RNA is a non-resident, direct action infector of .COM
and .EXE programs. It does not infect COMMAND.COM.
When a program infected with RNA is executed, the RNA virus will
infect up to four .COM and .EXE programs located in the current
directory. Infected programs will have a file length increase
of 7,296 bytes with the virus being located at the beginning of
the infected file. The program's date and time in the DOS disk
directory listing will not be altered.
The following text strings can be found in RNA infected programs:
"Runtime error at"
Systems infected with the RNA virus will experience intermittent
system hangs when infected programs are executed. The user may
also notice that zero-byte files may be created in the current
drive and directory. Disk accesses to other than the current
drive may also occur, but the virus doesn't actually infect any
files other than on the current drive.
Known variant(s) of RNA are:
RNA-7408: RNA-7408, or RNA2, was submitted in April, 1992.
It is similar in behavior to the original virus, though
.EXE programs are given preference for infection over
.COM programs. Infected programs will have a file
length increase of 7,408 bytes with the virus being
located at the beginning of the file. The following
text strings can be found within the viral code in
"Runtime error at"
"Portions Copyright (c) 1983,90 Borland"
Origin: Unknown April, 1992