Virus Name: RTL4
V Status: Rare
Discovery: December, 1992
Symptoms: .COM file growth; message; system hangs
Origin: The Netherlands
Eff Length: 503 Bytes
Type Code: PNCK - Parasitic Non-Resident .COM Infector
Detection Method: ViruScan, Sweep, AVTK, F-Prot, IBMAV, PCScan,
NAV, NAVDX, VAlert, ChAV,
NShld, Sweep/N, AVTK/N, LProt, NAV/N, NProt, IBMAV/N,
Removal Instructions: Delete infected files
The RTL4 virus was submitted in December, 1992, and is from The
Netherlands. RTL4 is a non-resident, direct action infector of
.COM programs, including COMMAND.COM.
When a program infected with the RTL4 virus is executed, the RTL4
virus will infect one .COM program located in the current directory,
along with displaying the following message:
"Joop van den Ende Produkties BV
Marco Daas (Casting Assistent)
1430 AJ AALSMEER
van Cleeffkade 15
1413 BA AALSMEER
Wedden dat... je een virus hebt?"
A system hang will then occur. The above text is encrypted within
infected files, so it is not visible.
Programs infected with the RTL4 virus will have a file length
increase of 503 bytes with the virus being located at the end of
the file. The program's date and time in the DOS disk directory
listing will not be altered. In addition to the above text, the
following text string is also encrypted within infected files:
The individual and the addresses indicated above are displayed
by the virus, but should not be construed to indicate that this
individual wrote the virus.