Virus Name: Pa
V Status: Rare
Discovery: June, 1992
Symptoms: .EXE file growth; message displayed; infected programs fail
to execute; file time change
Eff Length: 5,792 Bytes
Type Code: PNE - Parasitic Non-Resident .EXE Infector
Detection Method: AVTK, F-Prot, Sweep, ViruScan, ChAV,
IBMAV, NAV, NAVDX, VAlert, PCScan,
NShld, Sweep/N, Innoc, AVTK/N, NAV/N, NProt, IBMAV/N,
Removal Instructions: Delete infected files
The Pa, or 5792, virus was received in June, 1992. Its origin is
unknown, though it is probably from Eastern Europe. Pa is a
non-resident direct action infector of .EXE programs.
When a program infected with the Pa virus is executed, the Pa virus
may infect up to three .EXE programs located on the C: drive. The
virus will start looking for files to infect in the root directory,
moving down through the directory structure. Programs infected
with the Pa virus will have a file length increase of 5,792 bytes
with the virus being located at the beginning of the file. The
program's date in the DOS disk directory will not be altered, but
the minutes in the file's time will have been set to 57. Once the
virus has infected three .EXE programs, the following error message
will be displayed and the user will be returned to the DOS prompt:
"Error in *.EXE file."
Occassionally when a Pa infected program is executed, the following
message will be displayed by the virus and the user will be returned
to the DOS prompt:
"Pa,pa slodki bobasku ..."
This message is not visible within infected programs.