RPVS Virus (10-February-1991)
Entry..............: RPVS Virus
Alias(es)..........: TUQ = 453 Virus
Strain.............: ---
Detected: when.....: 1-August-1990
          where....: Suedwestdeutscher Bibliotheksverbund
                       (located at University of Konstanz, Germany)
Classification.....: Link virus, direct action COM infector
Length of virus....: 453 bytes added to COM files
-------------------- Preconditions -----------------------------------
Operating System(s): MS-DOS
Version/Release....: 2.0+
Computer models....: All MS-DOS-Machines
-------------------- Attributes --------------------------------------
Easy identification: File size increased by 453 bytes. The following 
                        offsets are taken relative to the address        
                        the JMP instruction (cf. infra) points to:
                        offset | string / bytes found
                        -------+----------------------------------
                          007  | "VIRUS"
                          00D  | "*.COM"
                          013  | "????????COM"
                          030  | file-id of the infected program
                          043  | original contents of 1st 3 bytes
                          052  | "TUQ(?)RPVS"
Self-identification: Last two bytes = 9090(hex). When an infected file
                        is executed, one uninfected .COM-file in cur-
                        rent directory is infected by appending the 
                        viral code.
Type of infection..: Direct action. Begin of program is overwritten 
                        with JMP instruction pointing to appended 
                        viral code.
Infection trigger..: Executing an infected file will trigger the
                        infection attempt in the local directory.
                        Virus has been tested with one bait (at most)
                        available, so it is not clear whether multiple
                        programs will be infected. No files outside 
                        the local directory have been infected during 
                        tests.
Storage media affected: Current media (current directory).
Interrupts hooked..: ---
Damage.............: ---
Particularities....: ---
-------------------- Agents ------------------------------------------
Countermeasures....: Category 3: ANTI!453.EXE (d:) (/f)
Countermeasures successful: ANTI!453.EXE (Daniel Loeffler,VTC-Hamburg)
                       looks for infected files on a given drive (d:) 
                       and optionally removes the virus (if /f given).
Standard means.....: ---
-------------------- Acknowledgement ---------------------------------
Location...........: Rechenzentrum der University Konstanz
Classification by..: Otto Stolz <RZOTTO at DKNKURZ1.BITNET>
                     Daniel Loeffler (VTC-Hamburg)
Documentation by ..: Otto Stolz <RZOTTO at DKNKURZ1.BITNET>
                     Daniel Loeffler (VTC-Hamburg)
Date...............: 10-February-1991

.