Virus Name: Piter-1228
V Status: Rare
Discovery: March, 1993
Symptoms: .COM & .EXE growth; file date/time changed to 0-00-83 12:05a
decrease in total system & available free memory
Eff Length: 1,228 Bytes
Type Code: PRhAK - Parasitic Resident .COM & .EXE Infector
Detection Method: F-Prot, IBMAV, NAV, Sweep, AVTK, ViruScan,
NAVDX, VAlert, PCScan, ChAV,
Sweep/N, NShld, NProt, AVTK/N, NAV/N, IBMAV/N, Innoc,
Removal Instructions: Delete infected files
The Piter-1228 virus was submitted in March, 1993. Its origin is
unknown. Piter-1228 is a memory resident infector of .COM and .EXE
programs, including COMMAND.COM.
When the first Piter-1228 infected program is executed, this virus
will install itself memory resident at the top of system memory but
below the 640K DOS boundary, hooking interrupts 09 and 21.
Interrupt 12's return will not be moved. Total system and available
free memory, as indicated by the DOS CHKDSK program, will have been
decreased by 1,376 bytes.
Once the Piter-1228 virus is memory resident, it will infect .COM and
.EXE programs, including COMMAND.COM, when they are executed.
Infected programs will have a file length increase of 1,228 bytes
with the virus being located at the end of the file. The file's date
and time in the DOS disk directory listing will have been altered to
the value "0-00-83 12:05a". The following text strings are visible
within the Piter-1228 viral code in infected files:
"Recommendation for restart make use of RESET"
It is unknown what Piter-1228 may do besides replicate.