Mercy Virus

 Virus Name:  Mercy 
 Aliases:     Systers Of Mercy 
 V Status:    New 
 Discovered:  December, 1994 
 Symptoms:    .EXE file growth; 
              decrease in total system & available free memory 
 Origin:      Unknown 
 Eff Length:  1,151 - 1,165 Bytes 
 Type Code:   PRhE - Parasitic Resident .EXE Infector 
 Detection Method:  ViruScan, NAV, NAVDX, AVTK 7.68+, 
                    NShld, NAV/N, AVTK/N 7.68+ 
 Removal Instructions:  Delete infected files 
 General Comments: 
       The Mercy or Systers Of Mercy virus was received in December, 1994. 
       Its origin or point of isolation is unknown.  Mercy is a memory 
       resident infector of .EXE files. 
       When the first Mercy infected program is executed, this virus will 
       become memory resident at the top of system memory but below the 640K 
       DOS boundary, not moving interrupt 12's return.  Total system and 
       available free memory, as indicated by the DOS CHKDSK program, will 
       have decreased by 1,824 bytes.  Interrupts 08 and 21 will be hooked 
       by the virus in memory. 
       Once the Mercy virus is memory resident, it will infect .EXE files 
       when they are executed.  Infected programs will have a file length 
       increase of 1,151 to 1,165 bytes with the virus being located at the 
       end of the file.  The program's date and time in the DOS disk 
       directory listing will not be altered.  The following text string is 
       visible within the viral code in all infected files: 
               "SYSTERS OF MERCY V2.0 MS 94" 
       It is unknown what this virus does besides replicate. 

Show viruses from discovered during that infect .

Main Page