Virus Name: Pregnant
V Status: Rare
Discovered: September, 1991
Symptoms: .COM file growth; decrease in total system and available free
memory; files renamed to "PREGNANT"
Eff Length: 1,199 Bytes
Type Code: PRhCK - Parasitic Resident .COM Infector
Detection Method: ViruScan, AVTK, Sweep, F-Prot, NAV, IBMAV,
NAVDX, VAlert, PCScan, ChAV,
NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N,
Removal Instructions: Delete infected files
The Pregnant virus was discovered and submitted in September, 1991.
Pregnant is a memory resident infector of .COM files, including
The first time a program infected with Pregnant is executed, Pregnant
will install itself memory resident at the top of system memory but
below the 640K DOS boundary. Total system and available free memory,
as indicated by the DOS CHKDSK program, will have decreased by
2,048 bytes. Interrupt 21 will be hooked by the virus.
Once memory resident, Pregnant will infect .COM programs when they
are executed. This virus hides the file length increase when it is
memory resident, so the user will not see a file length increase
when a directory listing is performed. The infected .COM files
actually increase in size by 1,199 bytes with the virus being
located at the beginning of the infected program. Programs which
originally had a file time of 12:00a in the disk directory will now
appear to have a blank time when the virus is memory resident.
Pregnant activates based on some future date or event, at which time
it will change the file names in directories to "PREGNANT". The
triggering factor has not yet been determined.