Pixie Virus


 Virus Name:  Pixie 
 Aliases:     Pixie 1.0 
 V Status:    Rare 
 Discovered:  December, 1991 
 Symptoms:    .COM file growth; Disk read errors; file date/time change 
 Origin:      United States 
 Eff Length:  812 Bytes (and multiples thereof) 
 Type Code:   PNCK - Parasitic Non-Resident .COM Infector 
 Detection Method:  NAV, ViruScan, F-Prot, AVTK, ChAV, 
                    IBMAV, Sweep, NAVDX, VAlert, PCScan, 
                    NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, 
                    NAV/N, IBMAV/N 
 Removal Instructions:  Delete infected files 
 
 General Comments: 
       The Pixie, or Pixie 1.0, virus was received in December, 1991 from 
       a source in the United States.  Pixie is a non-resident, direct 
       action infector of .COM files, including COMMAND.COM.  It is very 
       buggy. 
 
       When a program infected with Pixie is executed, the Pixie virus will 
       infect all of the .COM files in the current directory.  A bug in 
       this virus is that it does not recognize when it has completed 
       infecting all of the .COM files, so it promptly starts reinfecting 
       them.  This will continue until the user reboots the system. 
 
       Pixie infected .COM files will have file length increase of 812 
       bytes, though usually the file length increase will be a multiple 
       of 812 due to the reinfections.  The virus will be located at the 
       beginning of the infected file.  The file's date and time in the 
       DOS disk directory will have been updated to the system date and 
       time when the last infection / reinfection occurred. 
     
       The following text strings can be found in all Pixie infected 
       files: 
 
               "The Pixie Virus v1.0 - Written by NegativX" 
               "- Copyright (c) 1991, -SiTT-" 
               "*.COM" 
 
       The Pixie virus is actually much smaller than 812 bytes, around 
       306 bytes in length.  The additional bytes will be filled with 
       binary 00 characters, or random data from memory. 
 
       Execution of .COM files infected with the Pixie virus may result 
       in a Disk read error occurring.  This error is on the file due to 
       the user rebooting while the virus was writing to the file. 
 
       Known variant(s) of Pixie are: 
       Pixie 1.0B: A minor variant of the Pixie virus, this variant 
                   is functionally similar. 
                   Origin:  Unknown  May, 1992. 
 
       See:   Pixel

Show viruses from discovered during that infect .

Main Page