Pitch Virus

Virus Name: Pitch Aliases: V Status: Rare Discovery: June, 1992 Symptoms: .COM file growth; TSR; high pitched noise emitted from system speaker Origin: France Eff Length: 593 Bytes Type Code: PRsCK - Parasitic Resident .COM Infector Detection Method: ViruScan, Sweep, AVTK, F-Prot, IBMAV, NAVDX, NAV, VAlert, PCScan, ChAV, NShld, Sweep/N, Innoc, AVTK/N, NAV/N, NProt, IBMAV/N, LProt Removal Instructions: Delete infected files General Comments: The Pitch virus was discovered in France in June, 1992. Pitch is a memory resident infector of .COM programs, including COMMAND.COM. It can be a very noisy virus. When the first Pitch infected program is executed, the Pitch virus will install itself memory resident as a low system memory TSR of 1,568 bytes. It will hook interrupts 1C, 21, 25, 26, 2F, and 47. In addition to the TSR, it will also allocate an additional 64K of memory, so available free memory will actually decrease by 65,680 bytes. Also at this time, the virus will infect the first .COM program on both the current and C: drives. Once the Pitch virus is memory resident, it will infect .COM programs when they are executed, along with one additional .COM program. Infections occur on the current drive and drive C:. Infected programs will have a file length increase of 593 bytes with the virus being located at the beginning of the infected file. The following text strings can be found within all infected files: "*.com .. *.*" "???????????" "DOS COM" After the Pitch virus has been memory resident for 15 to 30 minutes, it will emit a high pitched noise from the system speaker. Known variant(s) of Pitch are: Pitch-B: Functionally equivalent to the original virus, this variant has five bytes which differ. Origin: France June, 1992.