F-Secure Virus Descriptions : Pixel
This virus is not very interesting, but nevertheless multiple variants are
known. The virus code is only around 334 bytes, which made it for a while
one of the shortest PC virus known. The rest contains zeros and a text
string which is occasionally displayed. Until the virus reaches the 5th
generation, no effects are visible, but in generation 5 or later there is a
50% chance that the message will appear.
One variant contains an advertisement for Amstrad computers, but in
another one the message is different:
En tu PC hay un virus RV1, y ‚sta es su quinta generaci¢n.
Originally this virus was published in a Greek magazine named "Pixel" in
the form of a BASIC program that would create an infected program when run.
This program contained a different message:
"Program sick error: Call doctor or buy PIXEL for cure description"
A disinfection program, written by the virus author was then published in
the next issue of Pixel.
This is a "buggy" 740 byte variant.
Numerous other variants of this virus are now known, most from Bulgaria.
The major difference is in the length - ranging from 257 to 936 bytes. It
seems that some virus writers there are competing with each other to create
the shortest possible version of the virus. One of the shortest variant,
with a length of 277 displays a "PARITY ERROR" message when it activates,
simulating a hardware failure. This variant is similar to one 300 byte
variant from Russia.
Two variants of the virus were first reported in Poland. They are 550 and
457 bytes long and employ a primitive self-modification mechanism.
The smallest variant by far, only 131 bytes.
|
![](/images/pixel.gif"){kind=tracking}
