Spanish April Fools Virus
Virus Name: Spanish April Fools
Aliases: December 28th
V Status: Rare
Discovered: June, 1991
Symptoms: .EXE file growth; TSR; system hangs; copy, delete, and
rename commands may fail
Eff Length: 1,417 Bytes
Type Code: PRsE - Parasitic Resident .EXE Infector
Detection Method: ViruScan, AVTK, Sweep, F-Prot, NAV, PCScan,
IBMAV, NAVDX, VAlert, ChAV,
NShld, Sweep/N, Innoc, AVTK/N, LProt, IBMAV/N,
Removal Instructions: Delete infected files
The Spanish April Fools, or December 28th, virus was isolated in
June, 1991, in the Zaragoza area of Spain. It is reported to be
widespread in that area. Spanish April Fools is a memory resident
infector of .EXE programs.
When the first Spanish April Fools virus infected program is
executed, the virus will install itself memory resident as a low
system memory TSR of 1,808 bytes. Interrupts 21 and 28 will be
hooked by the virus in memory.
After Spanish April Fools has been memory resident for several
minutes, it will start infecting .EXE programs when they are
opened or executed. Infected .EXE programs will increase in size
by 1,417 to 1,431 bytes. The virus will be located at the end of
infected programs. There will be no change in the file date and
time in the disk directory.
Spanish April Fools activates if it becomes memory resident when
the system date is December 28th of any year. Upon activation,
it will sporatically interfer with execution of some DOS internal
commands, such as COPY, RENAME, and DELETE. These commands may not
function properly when they involve .EXE programs, either not
executing the command, or hanging the system.