Pay Rise Virus


 Virus Name:  Pay Rise 
 Aliases:     Dennis, Pay Rise-897 
 V Status:    Rare 
 Discovered:  March, 1993 
 Symptoms:    .COM & .EXE growth; decrease in total system & available free 
              memory 
 Origin:      England 
 Eff Length:  897 Bytes 
 Type Code:   PRhAK - Parasitic Resident .COM & .EXE Infector 
 Detection Method:  Sweep, AVTK, F-Prot, ViruScan, PCScan, 
                    IBMAV, NAV, NAVDX, VAlert, ChAV, 
                    Sweep/N, NShld, AVTK/N, IBMAV/N, Innoc, NAV/N, LProt 
 Removal Instructions:  Delete infected files 
 
 General Comments: 
       The Pay Rise, Pay Rise-897 or Dennis, virus was submitted in 
       March, 1993.  It is originally from England.  Pay Rise is a memory 
       resident infector of .COM and .EXE programs, including COMMAND.COM. 
 
       When the first Pay Rise infected program is executed, the Pay Rise 
       virus will install itself memory resident at the top of system 
       memory but below the 640K DOS boundary.  It does not move interrupt 
       12's return.  Total system and available free memory, as indicated 
       by the DOS CHKDSK program, will have decreased by 1,872 bytes. 
       Interrupt 21 will be hooked by the Pay Rise virus in memory. 
 
       Once memory resident, the Pay Rise virus will infect .COM and .EXE 
       programs when they are executed.  Infected programs will have a 
       file length increase of 897 bytes with the virus being located at 
       the end of the file.  The program's date and time in the DOS disk 
       directory listing will not be altered.  The following text strings 
       are encrypted within the Pay Rise viral code: 
 
               "[Dennis-1] Apache Warrior, -= ARCV =-." 
               "To Dennis Yelle You Need A Pay Rise!" 
               "McAfee Eat Lead............" 
 
       It is unknown what Pay Rise may do besides replicate. 
 
       Known variant(s) of Pay Rise are: 
       Pay Rise-874: An 874 byte variant of the Pay Rise virus 
                     described above, this variant's size in memory is 
                     1,824 bytes, hooking interrupt 21.  It adds 874 
                     bytes to the .COM and .EXE programs it infects, 
                     and contains the same encrypted text strings as the 
                     original virus. 
                     Origin:  England  March, 1993. 

Show viruses from discovered during that infect .

Main Page