Mercy Virus

Virus Name: Mercy Aliases: Systers Of Mercy V Status: New Discovered: December, 1994 Symptoms: .EXE file growth; decrease in total system & available free memory Origin: Unknown Eff Length: 1,151 - 1,165 Bytes Type Code: PRhE - Parasitic Resident .EXE Infector Detection Method: ViruScan, NAV, NAVDX, AVTK 7.68+, NShld, NAV/N, AVTK/N 7.68+ Removal Instructions: Delete infected files General Comments: The Mercy or Systers Of Mercy virus was received in December, 1994. Its origin or point of isolation is unknown. Mercy is a memory resident infector of .EXE files. When the first Mercy infected program is executed, this virus will become memory resident at the top of system memory but below the 640K DOS boundary, not moving interrupt 12's return. Total system and available free memory, as indicated by the DOS CHKDSK program, will have decreased by 1,824 bytes. Interrupts 08 and 21 will be hooked by the virus in memory. Once the Mercy virus is memory resident, it will infect .EXE files when they are executed. Infected programs will have a file length increase of 1,151 to 1,165 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory listing will not be altered. The following text string is visible within the viral code in all infected files: "SYSTERS OF MERCY V2.0 MS 94" It is unknown what this virus does besides replicate.