RNA Virus

Virus Name: RNA Aliases: V Status: Rare Discovery: March, 1992 Symptoms: .COM & .EXE growth; zero byte files created; system hangs Origin: Unknown Eff Length: 7,296 Bytes Type Code: PNA - Parasitic Non-Resident .COM & .EXE Infector Detection Method: ViruScan, AVTK, F-Prot, Sweep, NAV, IBMAV, NAVDX, VAlert, PCScan, ChAV, NShld, Sweep/N, Innoc, AVTK/N, NAV/N, NProt, IBMAV/N, LProt Removal Instructions: Delete infected files General Comments: The RNA virus was submitted in March, 1992. Its origin is unknown. RNA is a non-resident, direct action infector of .COM and .EXE programs. It does not infect COMMAND.COM. When a program infected with RNA is executed, the RNA virus will infect up to four .COM and .EXE programs located in the current directory. Infected programs will have a file length increase of 7,296 bytes with the virus being located at the beginning of the infected file. The program's date and time in the DOS disk directory listing will not be altered. The following text strings can be found in RNA infected programs: "COMMAND.COM" "Runtime error at" "uc253.rqz" Systems infected with the RNA virus will experience intermittent system hangs when infected programs are executed. The user may also notice that zero-byte files may be created in the current drive and directory. Disk accesses to other than the current drive may also occur, but the virus doesn't actually infect any files other than on the current drive. Known variant(s) of RNA are: RNA-7408: RNA-7408, or RNA2, was submitted in April, 1992. It is similar in behavior to the original virus, though .EXE programs are given preference for infection over .COM programs. Infected programs will have a file length increase of 7,408 bytes with the virus being located at the beginning of the file. The following text strings can be found within the viral code in infected programs: "Runtime error at" "Portions Copyright (c) 1983,90 Borland" Origin: Unknown April, 1992