Pa Virus

Virus Name: Pa Aliases: 5792 V Status: Rare Discovery: June, 1992 Symptoms: .EXE file growth; message displayed; infected programs fail to execute; file time change Origin: Unknown Eff Length: 5,792 Bytes Type Code: PNE - Parasitic Non-Resident .EXE Infector Detection Method: AVTK, F-Prot, Sweep, ViruScan, ChAV, IBMAV, NAV, NAVDX, VAlert, PCScan, NShld, Sweep/N, Innoc, AVTK/N, NAV/N, NProt, IBMAV/N, LProt Removal Instructions: Delete infected files General Comments: The Pa, or 5792, virus was received in June, 1992. Its origin is unknown, though it is probably from Eastern Europe. Pa is a non-resident direct action infector of .EXE programs. When a program infected with the Pa virus is executed, the Pa virus may infect up to three .EXE programs located on the C: drive. The virus will start looking for files to infect in the root directory, moving down through the directory structure. Programs infected with the Pa virus will have a file length increase of 5,792 bytes with the virus being located at the beginning of the file. The program's date in the DOS disk directory will not be altered, but the minutes in the file's time will have been set to 57. Once the virus has infected three .EXE programs, the following error message will be displayed and the user will be returned to the DOS prompt: "Error in *.EXE file." Occassionally when a Pa infected program is executed, the following message will be displayed by the virus and the user will be returned to the DOS prompt: "Pa,pa slodki bobasku ..." This message is not visible within infected programs.