Pay Rise Virus
Virus Name: Pay Rise
Aliases: Dennis, Pay Rise-897
V Status: Rare
Discovered: March, 1993
Symptoms: .COM & .EXE growth; decrease in total system & available free
Eff Length: 897 Bytes
Type Code: PRhAK - Parasitic Resident .COM & .EXE Infector
Detection Method: Sweep, AVTK, F-Prot, ViruScan, PCScan,
IBMAV, NAV, NAVDX, VAlert, ChAV,
Sweep/N, NShld, AVTK/N, IBMAV/N, Innoc, NAV/N, LProt
Removal Instructions: Delete infected files
The Pay Rise, Pay Rise-897 or Dennis, virus was submitted in
March, 1993. It is originally from England. Pay Rise is a memory
resident infector of .COM and .EXE programs, including COMMAND.COM.
When the first Pay Rise infected program is executed, the Pay Rise
virus will install itself memory resident at the top of system
memory but below the 640K DOS boundary. It does not move interrupt
12's return. Total system and available free memory, as indicated
by the DOS CHKDSK program, will have decreased by 1,872 bytes.
Interrupt 21 will be hooked by the Pay Rise virus in memory.
Once memory resident, the Pay Rise virus will infect .COM and .EXE
programs when they are executed. Infected programs will have a
file length increase of 897 bytes with the virus being located at
the end of the file. The program's date and time in the DOS disk
directory listing will not be altered. The following text strings
are encrypted within the Pay Rise viral code:
"[Dennis-1] Apache Warrior, -= ARCV =-."
"To Dennis Yelle You Need A Pay Rise!"
"McAfee Eat Lead............"
It is unknown what Pay Rise may do besides replicate.
Known variant(s) of Pay Rise are:
Pay Rise-874: An 874 byte variant of the Pay Rise virus
described above, this variant's size in memory is
1,824 bytes, hooking interrupt 21. It adds 874
bytes to the .COM and .EXE programs it infects,
and contains the same encrypted text strings as the
Origin: England March, 1993.