Pi Virus

Virus Name: Pi Aliases: V Status: Rare Discovered: August, 1992 Symptoms: .EXE file growth; TSR; file date/time changes Origin: Unknown Eff Length: 1,552 - 1,568 Bytes Type Code: PRsE - Parasitic Resident .EXE Infector Detection Method: F-Prot, AVTK, ViruScan, Sweep, IBMAV, NAV, NAVDX, VAlert, PCScan, ChAV, NShld, Sweep/N, LProt, Innoc, NProt, AVTK/N, IBMAV/N, NAV/N Removal Instructions: Delete infected files General Comments: The Pi virus was received in August, 1992. Its origin or point of isolation is unknown. It is a memory resident infector of .EXE programs. When the first Pi infected program is executed, the Pi virus will install itself memory resident as a low system memory TSR of 2,048 bytes. It hooks interrupts 1C and 21. Once the Pi virus is memory resident, it will infect .EXE programs when they are executed. Infected programs will have a file length increase of 1,552 to 1,568 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory listing will have been updated to the current system date and time when infection occurred. One text string is visible in the viral code in infected programs: "P I _ P I" After Pi has been memory resident for approximately 10 minutes, it will display the above text in the upper right hand corner of the system display.