Virus Name: Pirate
V Status: Viron
Discovered: September, 1991
Symptoms: .COM program corruption; system hangs
Origin: Lisbon, Portugal
Eff Length: 609 Bytes
Type Code: ONCK - Overwriting Non-Resident .COM Infector
Detection Method: ViruScan, AVTK, Sweep, F-Prot, ChAV,
NAV, IBMAV, NAVDX, VAlert, PCScan,
NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N,
Removal Instructions: Delete infected files
The Pirate virus was discovered in Lisbon, Portugal in September,
1991, by Pedro Lima. Pirate is a non-resident overwriting virus
which infects .COM files, including COMMAND.COM.
When a program infected with Pirate is executed, this virus will
search the currect directory for an uninfected .COM file. When
it finds an uninfected file, it will infect it, overwriting the
first 609 bytes of the program. Programs infected with Pirate will
only increase in size if their original file length was less than
609 bytes. If the original length was less than 609 bytes, then
the file length will become 609 bytes. There will be no change
in the file's date and time in the DOS disk directory.
If Pirate does not find an .COM file to infect, it will continue
searching the current directory until the user reboots the system.
Attempts to boot the system from disks with a Pirate infected
COMMAND.COM will result in a system hang.
The following text string can be found in all programs infected
"1989 / 1990 Software Pirates - Fast Serial - Portugal"