Virus Name: Pisello
V Status: Rare
Discovery: February, 1992
Symptoms: .EXE file growth; TSR
Eff Length: 1,030 - 1,040 Bytes
Type Code: PRsE - Parasitic Resident .EXE Infector
Detection Method: ViruScan, F-Prot, Sweep, AVTK, NAV,
IBMAV, NAVDX, VAlert, PCScan, ChAV,
NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N,
Removal Instructions: Delete infected files
The Pisello virus was received in February, 1992. It is originally
from Italy. The Pisello virus is a memory resident infector of .EXE
When the first Pisello infected program is executed, the Pisello
virus will install itself memory resident as a low system memory
TSR of 2,112 bytes. Interrupt F8 will be hooked by the TSR, with
other interrupts directly hooked by the virus that will not appear
as hooked with memory mapping utilities.
After the Pisello virus has become memory resident, it will infect
.EXE programs when they are executed. Infected programs will have
a file length increase of 1,030 to 1,040 bytes. The virus will
be located at the end of the program. The file's date and time in
the DOS disk directory listing will not be altered.
No text strings are visible in the viral code in Pisello infected
programs. The following text string is encrypted within the viral
"My name is PISello BYE 31-1-92"
It is unknown what Pisello does besides replicate.
Known variant(s) of Pisello are:
Pisello-B: Functionally equivalent to Pisello, Pisello-B is
a minor variant.
Origin: Unknown May, 1992.