Virus Name: Pitch
V Status: Rare
Discovery: June, 1992
Symptoms: .COM file growth; TSR; high pitched noise emitted from system
Eff Length: 593 Bytes
Type Code: PRsCK - Parasitic Resident .COM Infector
Detection Method: ViruScan, Sweep, AVTK, F-Prot, IBMAV, NAVDX,
NAV, VAlert, PCScan, ChAV,
NShld, Sweep/N, Innoc, AVTK/N, NAV/N, NProt, IBMAV/N,
Removal Instructions: Delete infected files
The Pitch virus was discovered in France in June, 1992. Pitch is
a memory resident infector of .COM programs, including COMMAND.COM.
It can be a very noisy virus.
When the first Pitch infected program is executed, the Pitch virus
will install itself memory resident as a low system memory TSR of
1,568 bytes. It will hook interrupts 1C, 21, 25, 26, 2F, and 47.
In addition to the TSR, it will also allocate an additional 64K of
memory, so available free memory will actually decrease by 65,680
bytes. Also at this time, the virus will infect the first .COM
program on both the current and C: drives.
Once the Pitch virus is memory resident, it will infect .COM programs
when they are executed, along with one additional .COM program.
Infections occur on the current drive and drive C:. Infected
programs will have a file length increase of 593 bytes with the
virus being located at the beginning of the infected file. The
following text strings can be found within all infected files:
"*.com .. *.*"
After the Pitch virus has been memory resident for 15 to 30 minutes,
it will emit a high pitched noise from the system speaker.
Known variant(s) of Pitch are:
Pitch-B: Functionally equivalent to the original virus, this
variant has five bytes which differ.
Origin: France June, 1992.