Pisello Virus

Virus Name: Pisello Aliases: 1030 V Status: Rare Discovery: February, 1992 Symptoms: .EXE file growth; TSR Origin: Italy Eff Length: 1,030 - 1,040 Bytes Type Code: PRsE - Parasitic Resident .EXE Infector Detection Method: ViruScan, F-Prot, Sweep, AVTK, NAV, IBMAV, NAVDX, VAlert, PCScan, ChAV, NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N Removal Instructions: Delete infected files General Comments: The Pisello virus was received in February, 1992. It is originally from Italy. The Pisello virus is a memory resident infector of .EXE programs. When the first Pisello infected program is executed, the Pisello virus will install itself memory resident as a low system memory TSR of 2,112 bytes. Interrupt F8 will be hooked by the TSR, with other interrupts directly hooked by the virus that will not appear as hooked with memory mapping utilities. After the Pisello virus has become memory resident, it will infect .EXE programs when they are executed. Infected programs will have a file length increase of 1,030 to 1,040 bytes. The virus will be located at the end of the program. The file's date and time in the DOS disk directory listing will not be altered. No text strings are visible in the viral code in Pisello infected programs. The following text string is encrypted within the viral code: "My name is PISello BYE 31-1-92" It is unknown what Pisello does besides replicate. Known variant(s) of Pisello are: Pisello-B: Functionally equivalent to Pisello, Pisello-B is a minor variant. Origin: Unknown May, 1992.