FANDOM


Virus.DOS.Pizelun is a memory resident parasitic encrypted virus on DOS. It's name refpaers to the alternation of Italian term "pisellone", which could refer to the male genitalia or to a person with low intellect .

There are 2 variants:

  • Virus.DOS.Pizelun.3599 (A and B)

Behavior

When the virus is loaded into memory, it first infects COMMAND.COM, followed by hooking INT 21h to infect any executable file that is run by writing itself to the end of the file. It also searches and infects files that are accessed by the GetDir function.

The virus behaves stealthy so that there is no observable file size change of the infected files.

The system may fail to recognize the infected COMMAND.COM after next boot, even it can be loaded on manual execution.

Advanced details

The following table shows the memory usage of the variants.

Variant Memory usage in bytes
Pizelun.3599 (A and B) 8,192

MD5 hashes:

Variant Hash
Pizelun.3599.a 32654433eda06d2fdf7981b16bd78dcb
Pizelun.3599.b a4710282c9085db933ad4e365f8f7d1d

Payload

The virus activates in May 1995 only and it contains 5 payloads.

When activated, the virus first displays the message:

PIZELUN attivato, attivatissimo!
Premere un tasto per continuare . . .

Translation (from Italian):

PIZELUN activated, very active!
Press any key to continue . . .

After that all characters to be displayed on the screen will be turned to lowercase. Additionally, the virus hooks INT 8, 10h and 15h in order to manifest itself in 4 different ways.

KeyLock state swap

The virus swaps the state of NumLock, CapsLock and ScrollLock, which interferes the user's input.

Pizelun payload1

Several payloads on one screenshot

Alternation of hard drive label

Instead of displaying the original label of the hard drive, it displays "pizelun", as long as the virus has been activated and stays memory.

Inverts the color palette

When a graphical program using colors is run, the virus inverts the color palette that the color display of every character on screen is inverted, even the user returns to DOS, the inverted state of color of the screen is not restored.

Video effect

If the user attempts to restart the machine via CTRL-ALT-DEL, the virus will run a snowy, static video effect which looks like the screen of lost channel of an old TV and disable the keyboard input. The payload is accompanied by a high-frequency tone produced by the PC speaker.

Other details

Pizelun is a direct variant of Froll.

The virus contains the encrypted internal text string:

Alüra?  ALF

References

  1. List of variants of the Pizelun virus on VX Heaven

Videos

Virus.DOS

Virus.DOS.Pizelun

Pizelun virus review by danooct1