Praying Virus

 Virus Name:  Praying   
 Aliases:     Praying.579 
 V Status:    Rare 
 Discovered:  July, 1993 
 Symptoms:    .COM file growth; 
              decrease in total system and available free memory 
 Origin:      Unknown 
 Eff Length:  579 Bytes 
 Type Code:   PRhCK - Parasitic Resident .COM Infector 
 Detection Method:  ViruScan, F-Prot, AVTK, Sweep, IBMAV, NAV, NAVDX, 
                    VAlert, PCScan, ChAV, 
                    NShld, Sweep/N, AVTK/N, IBMAV/N, NProt, NAV/N, Innoc, 
 Removal Instructions:  Delete infected files 
 General Comments: 
       The Praying virus was received in July, 1993.  Its origin or point 
       of isolation is unknown.  Praying is a memory resident infector of 
       .COM programs, including COMMAND.COM. 
       When the first Praying infected program is executed, this virus will 
       install itself memory resident at the top of system memory but below 
       the 640K DOS boundary, not moving interrupt 12's return.  Total 
       system and available free memory, as indicated by the DOS CHKDSK 
       program, will have decreased by 2,640 bytes.  Interrupts 1C and 21 
       will be hooked by Praying in memory. 
       Once the Praying virus is memory resident, it will infect .COM 
       programs when they are executed.  Infected programs will have a file 
       length increase of 579 bytes with the virus being located at the end 
       of the file.  The program's date and time in the DOS disk directory 
       listing will not be altered.  The following text string can be found 
       within the viral code in all Praying infected programs: 
               "Keep On Praying,Jesus!" 
       It is unknown what Praying does besides replicate. 
       Known variant(s) of Praying are: 
       Praying.587:  Received in January, 1995, Praying.587 is a 
              587 byte variant of the Praying virus described above.  It 
              adds 587 bytes to the .COM files it infects.  It contains 
              the text string: 
              "Keep On Praying,Jesus !" 

Show viruses from discovered during that infect .

Main Page