Virus Name: Praying
V Status: Rare
Discovered: July, 1993
Symptoms: .COM file growth;
decrease in total system and available free memory
Eff Length: 579 Bytes
Type Code: PRhCK - Parasitic Resident .COM Infector
Detection Method: ViruScan, F-Prot, AVTK, Sweep, IBMAV, NAV, NAVDX,
VAlert, PCScan, ChAV,
NShld, Sweep/N, AVTK/N, IBMAV/N, NProt, NAV/N, Innoc,
Removal Instructions: Delete infected files
The Praying virus was received in July, 1993. Its origin or point
of isolation is unknown. Praying is a memory resident infector of
.COM programs, including COMMAND.COM.
When the first Praying infected program is executed, this virus will
install itself memory resident at the top of system memory but below
the 640K DOS boundary, not moving interrupt 12's return. Total
system and available free memory, as indicated by the DOS CHKDSK
program, will have decreased by 2,640 bytes. Interrupts 1C and 21
will be hooked by Praying in memory.
Once the Praying virus is memory resident, it will infect .COM
programs when they are executed. Infected programs will have a file
length increase of 579 bytes with the virus being located at the end
of the file. The program's date and time in the DOS disk directory
listing will not be altered. The following text string can be found
within the viral code in all Praying infected programs:
"Keep On Praying,Jesus!"
It is unknown what Praying does besides replicate.
Known variant(s) of Praying are:
Praying.587: Received in January, 1995, Praying.587 is a
587 byte variant of the Praying virus described above. It
adds 587 bytes to the .COM files it infects. It contains
the text string:
"Keep On Praying,Jesus !"