Virus Name: Pyramid
V Status: New
Discovery: July, 1995
Symptoms: .COM file growth; file date/time changes
Eff Length: 457 - 465 Bytes
Type Code: PRaCK - Parasitic Resident .COM Infector
Detection Method: F-Prot, AVTK, Sweep, NAV, NAVDX, ViruScan, IBMAV,
Sweep/N, NAV/N, NShld, AVTK/N, IBMAV/N, Innoc
Removal Instructions: Delete infected files
The Pyramid virus was received in July, 1995. Its origin or point
of isolation is unknown. Pyramid is a memory resident infector of
.COM files, including COMMAND.COM.
When the first Pyramid infected program is executed, this virus
will install itself memory resident in allocated system memory.
Total system and available free memory, as indicated by the DOS
CHKDSK program, will not be altered. Interrupt 21 will be hooked
by the virus in memory.
Once the Pyramid virus is memory resident, it will infect .COM files
when they are executed, opened, or copied. Infected files will have
a file length increase of 457 to 465 bytes with the virus being
located at the end of the file. The program's date and time in the
DOS disk directory listing will have been updated to the current
system date and time when infection occurred. No text strings are
visible within the viral code.