Piter-1228 Virus

 Virus Name:  Piter-1228 
 V Status:    Rare 
 Discovery:   March, 1993 
 Symptoms:    .COM & .EXE growth; file date/time changed to 0-00-83 12:05a 
              decrease in total system & available free memory 
 Origin:      Unknown 
 Eff Length:  1,228 Bytes 
 Type Code:   PRhAK - Parasitic Resident .COM & .EXE Infector 
 Detection Method:  F-Prot, IBMAV, NAV, Sweep, AVTK, ViruScan, 
                    NAVDX, VAlert, PCScan, ChAV, 
                    Sweep/N, NShld, NProt, AVTK/N, NAV/N, IBMAV/N, Innoc, 
 Removal Instructions:  Delete infected files 
 General Comments: 
       The Piter-1228 virus was submitted in March, 1993.  Its origin is 
       unknown.  Piter-1228 is a memory resident infector of .COM and .EXE 
       programs, including COMMAND.COM. 
       When the first Piter-1228 infected program is executed, this virus 
       will install itself memory resident at the top of system memory but 
       below the 640K DOS boundary, hooking interrupts 09 and 21. 
       Interrupt 12's return will not be moved.  Total system and available 
       free memory, as indicated by the DOS CHKDSK program, will have been 
       decreased by 1,376 bytes. 
       Once the Piter-1228 virus is memory resident, it will infect .COM and 
       .EXE programs, including COMMAND.COM, when they are executed. 
       Infected programs will have a file length increase of 1,228 bytes 
       with the virus being located at the end of the file.  The file's date 
       and time in the DOS disk directory listing will have been altered to 
       the value "0-00-83 12:05a".  The following text strings are visible 
       within the Piter-1228 viral code in infected files: 
               "Recommendation for restart make use of RESET" 
       It is unknown what Piter-1228 may do besides replicate. 

Show viruses from discovered during that infect .

Main Page