RP3 Virus

Virus Name: RP3 Aliases: V Status: Rare Discovery: August, 1994 Symptoms: .EXE file growth; file date/time changes Origin: Unknown Eff Length: 785 - 1,041 Bytes Type Code: PNE - Parasitic Non-Resident .EXE Infector Detection Method: ViruScan, NAV, NAVDX, IBMAV, ChAV, Innoc, NShld, NAV/N, IBMAV/N Removal Instructions: Delete infected files General Comments: The RP3 virus was received in August, 1994. Its origin or point of isolation is unknown. RP3 is a non-resident, direct action infector of .EXE files. When a program infected with the RP3 virus is executed, this virus will infect up to five .EXE files located in the current directory. Infected programs will have a file length increase of 785 to 1,041 bytes with the virus being located at the end of the file. The actual file length increase can be calculated by taking the original file length and dividing by 256. Subtract the remainder from this calculation and subtract it from 256. This will give you the number of bytes over 785 which the virus will add to the file. The "filler" is added by the virus to the file after the viral code has been added. The file's date and time in the DOS disk directory listing will have been updated to the current system date and time when infection occurred. The following text strings can be found within the viral code in all infected files: "????????EXE" ".EXE" "*.EXE" Additional text strings may occur in the "filler" added by the virus to the end of the file, but these characters are from system memory at the time of infection and not part of the viral code.