Virus Name: Mercy
Aliases: Systers Of Mercy
V Status: New
Discovered: December, 1994
Symptoms: .EXE file growth;
decrease in total system & available free memory
Eff Length: 1,151 - 1,165 Bytes
Type Code: PRhE - Parasitic Resident .EXE Infector
Detection Method: ViruScan, NAV, NAVDX, AVTK 7.68+,
NShld, NAV/N, AVTK/N 7.68+
Removal Instructions: Delete infected files
The Mercy or Systers Of Mercy virus was received in December, 1994.
Its origin or point of isolation is unknown. Mercy is a memory
resident infector of .EXE files.
When the first Mercy infected program is executed, this virus will
become memory resident at the top of system memory but below the 640K
DOS boundary, not moving interrupt 12's return. Total system and
available free memory, as indicated by the DOS CHKDSK program, will
have decreased by 1,824 bytes. Interrupts 08 and 21 will be hooked
by the virus in memory.
Once the Mercy virus is memory resident, it will infect .EXE files
when they are executed. Infected programs will have a file length
increase of 1,151 to 1,165 bytes with the virus being located at the
end of the file. The program's date and time in the DOS disk
directory listing will not be altered. The following text string is
visible within the viral code in all infected files:
"SYSTERS OF MERCY V2.0 MS 94"
It is unknown what this virus does besides replicate.