Virus Name: RP3
V Status: Rare
Discovery: August, 1994
Symptoms: .EXE file growth; file date/time changes
Eff Length: 785 - 1,041 Bytes
Type Code: PNE - Parasitic Non-Resident .EXE Infector
Detection Method: ViruScan, NAV, NAVDX, IBMAV, ChAV,
Innoc, NShld, NAV/N, IBMAV/N
Removal Instructions: Delete infected files
The RP3 virus was received in August, 1994. Its origin or point of
isolation is unknown. RP3 is a non-resident, direct action infector
of .EXE files.
When a program infected with the RP3 virus is executed, this virus
will infect up to five .EXE files located in the current directory.
Infected programs will have a file length increase of 785 to 1,041
bytes with the virus being located at the end of the file. The
actual file length increase can be calculated by taking the original
file length and dividing by 256. Subtract the remainder from this
calculation and subtract it from 256. This will give you the number
of bytes over 785 which the virus will add to the file. The "filler"
is added by the virus to the file after the viral code has been
added. The file's date and time in the DOS disk directory listing
will have been updated to the current system date and time when
infection occurred. The following text strings can be found within
the viral code in all infected files:
Additional text strings may occur in the "filler" added by the virus
to the end of the file, but these characters are from system memory
at the time of infection and not part of the viral code.