Pisello Virus

 Virus Name:  Pisello 
 Aliases:     1030 
 V Status:    Rare 
 Discovery:   February, 1992 
 Symptoms:    .EXE file growth; TSR 
 Origin:      Italy 
 Eff Length:  1,030 - 1,040 Bytes 
 Type Code:   PRsE - Parasitic Resident .EXE Infector 
 Detection Method:  ViruScan, F-Prot, Sweep, AVTK, NAV, 
                    IBMAV, NAVDX, VAlert, PCScan, ChAV, 
                    NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, 
                    NAV/N, IBMAV/N 
 Removal Instructions:  Delete infected files 
 General Comments: 
       The Pisello virus was received in February, 1992.  It is originally 
       from Italy.  The Pisello virus is a memory resident infector of .EXE 
       When the first Pisello infected program is executed, the Pisello 
       virus will install itself memory resident as a low system memory 
       TSR of 2,112 bytes.  Interrupt F8 will be hooked by the TSR, with 
       other interrupts directly hooked by the virus that will not appear 
       as hooked with memory mapping utilities. 
       After the Pisello virus has become memory resident, it will infect 
       .EXE programs when they are executed.  Infected programs will have 
       a file length increase of 1,030 to 1,040 bytes.  The virus will 
       be located at the end of the program.  The file's date and time in 
       the DOS disk directory listing will not be altered. 
       No text strings are visible in the viral code in Pisello infected 
       programs.  The following text string is encrypted within the viral 
               "My name is PISello BYE 31-1-92" 
       It is unknown what Pisello does besides replicate. 
       Known variant(s) of Pisello are: 
       Pisello-B: Functionally equivalent to Pisello, Pisello-B is 
                  a minor variant. 
                  Origin:  Unknown  May, 1992. 

Show viruses from discovered during that infect .

Main Page