Virus Name: Pit
V Status: New
Discovery: January, 1995
Symptoms: .COM file growth; file date/time changes
Eff Length: 611 - 620 Bytes
Type Code: PNCK - Parasitic Non-Resident .COM Infector
Detection Method: F-Prot, ViruScan, IBMAV, AVTK, Sweep, NAVDX, VAlert,
NShld, NProt, IBMAV/N, AVTK/N, Sweep/N, NAV/N, Innoc 4.0+
Removal Instructions: Delete infected files
The Pit virus was received in January, 1995. Its origin or point
of isolation is unknown. Pit is a non-resident, direct action
infector of .COM files, including COMMAND.COM.
When a program infected with the Pit virus is executed, this virus
will infect all of the .COM files located in the current directory.
Infected programs will have a file length increase of 611 to 620
bytes with the virus being located at the end of the file. The
program's date and time in the DOS disk directory listing will have
been updated to the current system date and time when infection
occurred. The following text string is visible within the viral
code in all infected files:
"The Pit v1.20"
It is unknown what the Pit virus does besides replicate.
Known variant(s) of Pit are:
Pit.611.B: Received in January, 1996, this is a minor
variant of the Pit virus described above. It infects all
of the .COM files in the current directory when an infected
program is executed, increasing their length by 611 to 622
bytes. The virus will be located at the end of the file. The
program's date and time in the DOS disk directory listing will
have been updated to the current system date and time when
infection occurred. The following text string is visible within
the viral code:
"02.1v tiP ehT"
Some programs may fail to function properly once infected by
Origin: Unknown January, 1996.