| Description:
|
Details
Piaf.1859
It is not a dangerous memory resident parasitic encrypted virus. It hooks INT 21h and infects COM and EXE files that are executed, opened or renamed. It writes itself to the beginning of COM files and to the end of EXE files. It does not infect the files with the names which begins with two symbols that present in the string:
NDIOOSUVRAIVFP
I.e. the virus does not infect the files ND*.*, IO*.*, etc.
If this virus cannot install its TSR copy, it displays the message "Incorrect DOS version" and returns to DOS. While installing it traces INT 13h, 21h and searches for specific code in DOS code area, that information is used while infecting the file to disable antiviral monitors.
Some infected files display when they are executed:
Copyright (c) 1991-1992 by Xxxxx III!
This virus also contains the text strings:
PIAF
EXECOM |
