Praying Virus

Virus Name: Praying Aliases: Praying.579 V Status: Rare Discovered: July, 1993 Symptoms: .COM file growth; decrease in total system and available free memory Origin: Unknown Eff Length: 579 Bytes Type Code: PRhCK - Parasitic Resident .COM Infector Detection Method: ViruScan, F-Prot, AVTK, Sweep, IBMAV, NAV, NAVDX, VAlert, PCScan, ChAV, NShld, Sweep/N, AVTK/N, IBMAV/N, NProt, NAV/N, Innoc, LProt Removal Instructions: Delete infected files General Comments: The Praying virus was received in July, 1993. Its origin or point of isolation is unknown. Praying is a memory resident infector of .COM programs, including COMMAND.COM. When the first Praying infected program is executed, this virus will install itself memory resident at the top of system memory but below the 640K DOS boundary, not moving interrupt 12's return. Total system and available free memory, as indicated by the DOS CHKDSK program, will have decreased by 2,640 bytes. Interrupts 1C and 21 will be hooked by Praying in memory. Once the Praying virus is memory resident, it will infect .COM programs when they are executed. Infected programs will have a file length increase of 579 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory listing will not be altered. The following text string can be found within the viral code in all Praying infected programs: "Keep On Praying,Jesus!" It is unknown what Praying does besides replicate. Known variant(s) of Praying are: Praying.587: Received in January, 1995, Praying.587 is a 587 byte variant of the Praying virus described above. It adds 587 bytes to the .COM files it infects. It contains the text string: "Keep On Praying,Jesus !"