Pyramid Virus

 Virus Name:  Pyramid 
 V Status:    New 
 Discovery:   July, 1995 
 Symptoms:    .COM file growth; file date/time changes 
 Origin:      Unknown 
 Eff Length:  457 - 465 Bytes 
 Type Code:   PRaCK - Parasitic Resident .COM Infector 
 Detection Method: F-Prot, AVTK, Sweep, NAV, NAVDX, ViruScan, IBMAV, 
                   Sweep/N, NAV/N, NShld, AVTK/N, IBMAV/N, Innoc 
 Removal Instructions:  Delete infected files 
 General Comments: 
       The Pyramid virus was received in July, 1995.  Its origin or point 
       of isolation is unknown.  Pyramid is a memory resident infector of 
       .COM files, including COMMAND.COM. 
       When the first Pyramid infected program is executed, this virus 
       will install itself memory resident in allocated system memory. 
       Total system and available free memory, as indicated by the DOS 
       CHKDSK program, will not be altered.  Interrupt 21 will be hooked 
       by the virus in memory. 
       Once the Pyramid virus is memory resident, it will infect .COM files 
       when they are executed, opened, or copied.  Infected files will have 
       a file length increase of 457 to 465 bytes with the virus being 
       located at the end of the file.  The program's date and time in the 
       DOS disk directory listing will have been updated to the current 
       system date and time when infection occurred.  No text strings are 
       visible within the viral code. 

Show viruses from discovered during that infect .

Main Page