Pregnant Virus

Virus Name: Pregnant Aliases: V Status: Rare Discovered: September, 1991 Symptoms: .COM file growth; decrease in total system and available free memory; files renamed to "PREGNANT" Origin: Unknown Eff Length: 1,199 Bytes Type Code: PRhCK - Parasitic Resident .COM Infector Detection Method: ViruScan, AVTK, Sweep, F-Prot, NAV, IBMAV, NAVDX, VAlert, PCScan, ChAV, NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N Removal Instructions: Delete infected files General Comments: The Pregnant virus was discovered and submitted in September, 1991. Pregnant is a memory resident infector of .COM files, including COMMAND.COM. The first time a program infected with Pregnant is executed, Pregnant will install itself memory resident at the top of system memory but below the 640K DOS boundary. Total system and available free memory, as indicated by the DOS CHKDSK program, will have decreased by 2,048 bytes. Interrupt 21 will be hooked by the virus. Once memory resident, Pregnant will infect .COM programs when they are executed. This virus hides the file length increase when it is memory resident, so the user will not see a file length increase when a directory listing is performed. The infected .COM files actually increase in size by 1,199 bytes with the virus being located at the beginning of the infected program. Programs which originally had a file time of 12:00a in the disk directory will now appear to have a blank time when the virus is memory resident. Pregnant activates based on some future date or event, at which time it will change the file names in directories to "PREGNANT". The triggering factor has not yet been determined.