Argentina Virus

Virus Name: Argentina Aliases: Argentina 1.0 V Status: Rare Discovery: October, 1991 Symptoms: .COM growth; TSR; messages on activation Origin: Buenos Aires, Argentina Eff Length: 1,249 Bytes Type Code: PRsC - Parasitic Resident .COM Infector Detection Method: ViruScan, AVTK, Sweep, F-Prot, IBMAV, NAV, NAVDX, VAlert, PCScan, ChAV, NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N Removal Instructions: Delete infected files General Comments: The Argentina virus was discovered in Buenos Aires, Argentina, in October, 1991. Argentina is a memory resident infector of .COM programs. It does not infect COMMAND.COM. The first time a program infected with Argentina is executed, the virus will install itself memory resident as a low system memory TSR of 1,568 bytes. Interrupt 21 will be hooked by the virus in memory. Once Argentina is memory resident, it will infect .COM programs other than COMMAND.COM when they are executed. Infected .COM programs will have a file size increase of 1,249 bytes with the virus being located at the beginning of the file. There will be no visible date/time change in the DOS disk directory. The Argentina virus activates on four dates, at which time it will display a message pertaining to the dates. These activation dates are of patriotic significance in Argentina. The dates and messages are as follows: May 25th: "25 de Mayo Declaracion de la independencia Argentina Argentina Virus escrito por AfA - Virus benigno - ENET 35 Pulse usa tecla para continuar" Jun 20th: "20 de Junio Dia de la bandera Argentina Argentina Virus escrito por AfA - Virus benigno - ENET 35 Pulse usa tecla para continuar" Jul 9th: "9 de Julio Dia de la independencia Argentina Argentina Virus escrito por AfA - Virus benigno - ENET 35 Pulse usa tecla para continuar" Aug 17th: "17 de Agosto Aniversario de la defuncion del Gral. San Martin Argentina Virus escrito por AfA - Virus benigno - ENET 35 Pulse usa tecla para continuar" Hitting any key when theses messages appear will result in the program being executed continuing. Besides the above messages, one other text string occurs within this virus: "Argentina Virus 1.00"