RP3 Virus

 Virus Name:  RP3 
 V Status:    Rare 
 Discovery:   August, 1994 
 Symptoms:    .EXE file growth; file date/time changes 
 Origin:      Unknown 
 Eff Length:  785 - 1,041 Bytes 
 Type Code:   PNE - Parasitic Non-Resident .EXE Infector 
 Detection Method:  ViruScan, NAV, NAVDX, IBMAV, ChAV, 
                    Innoc, NShld, NAV/N, IBMAV/N 
 Removal Instructions:  Delete infected files 
 General Comments: 
       The RP3 virus was received in August, 1994.  Its origin or point of 
       isolation is unknown.  RP3 is a non-resident, direct action infector 
       of .EXE files. 
       When a program infected with the RP3 virus is executed, this virus 
       will infect up to five .EXE files located in the current directory. 
       Infected programs will have a file length increase of 785 to 1,041 
       bytes with the virus being located at the end of the file.  The 
       actual file length increase can be calculated by taking the original 
       file length and dividing by 256.  Subtract the remainder from this 
       calculation and subtract it from 256.  This will give you the number 
       of bytes over 785 which the virus will add to the file.  The "filler" 
       is added by the virus to the file after the viral code has been 
       added.  The file's date and time in the DOS disk directory listing 
       will have been updated to the current system date and time when 
       infection occurred.  The following text strings can be found within 
       the viral code in all infected files: 
       Additional text strings may occur in the "filler" added by the virus 
       to the end of the file, but these characters are from system memory 
       at the time of infection and not part of the viral code. 

Show viruses from discovered during that infect .

Main Page