Virus Name: Pixie
Aliases: Pixie 1.0
V Status: Rare
Discovered: December, 1991
Symptoms: .COM file growth; Disk read errors; file date/time change
Origin: United States
Eff Length: 812 Bytes (and multiples thereof)
Type Code: PNCK - Parasitic Non-Resident .COM Infector
Detection Method: NAV, ViruScan, F-Prot, AVTK, ChAV,
IBMAV, Sweep, NAVDX, VAlert, PCScan,
NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N,
Removal Instructions: Delete infected files
The Pixie, or Pixie 1.0, virus was received in December, 1991 from
a source in the United States. Pixie is a non-resident, direct
action infector of .COM files, including COMMAND.COM. It is very
When a program infected with Pixie is executed, the Pixie virus will
infect all of the .COM files in the current directory. A bug in
this virus is that it does not recognize when it has completed
infecting all of the .COM files, so it promptly starts reinfecting
them. This will continue until the user reboots the system.
Pixie infected .COM files will have file length increase of 812
bytes, though usually the file length increase will be a multiple
of 812 due to the reinfections. The virus will be located at the
beginning of the infected file. The file's date and time in the
DOS disk directory will have been updated to the system date and
time when the last infection / reinfection occurred.
The following text strings can be found in all Pixie infected
"The Pixie Virus v1.0 - Written by NegativX"
"- Copyright (c) 1991, -SiTT-"
The Pixie virus is actually much smaller than 812 bytes, around
306 bytes in length. The additional bytes will be filled with
binary 00 characters, or random data from memory.
Execution of .COM files infected with the Pixie virus may result
in a Disk read error occurring. This error is on the file due to
the user rebooting while the virus was writing to the file.
Known variant(s) of Pixie are:
Pixie 1.0B: A minor variant of the Pixie virus, this variant
is functionally similar.
Origin: Unknown May, 1992.