Spanish April Fools Virus

 Virus Name:  Spanish April Fools 
 Aliases:     December 28th 
 V Status:    Rare 
 Discovered:  June, 1991 
 Symptoms:    .EXE file growth; TSR; system hangs; copy, delete, and 
              rename commands may fail 
 Origin:      Spain 
 Eff Length:  1,417 Bytes 
 Type Code:   PRsE - Parasitic Resident .EXE Infector 
 Detection Method:  ViruScan, AVTK, Sweep, F-Prot, NAV, PCScan, 
                    IBMAV, NAVDX, VAlert, ChAV, 
                    NShld, Sweep/N, Innoc, AVTK/N, LProt, IBMAV/N, 
                    NAV/N, NProt 
 Removal Instructions:  Delete infected files 
 General Comments: 
       The Spanish April Fools, or December 28th, virus was isolated in 
       June, 1991, in the Zaragoza area of Spain.  It is reported to be 
       widespread in that area.  Spanish April Fools is a memory resident 
       infector of .EXE programs. 
       When the first Spanish April Fools virus infected program is 
       executed, the virus will install itself memory resident as a low 
       system memory TSR of 1,808 bytes.  Interrupts 21 and 28 will be 
       hooked by the virus in memory. 
       After Spanish April Fools has been memory resident for several 
       minutes, it will start infecting .EXE programs when they are 
       opened or executed.  Infected .EXE programs will increase in size 
       by 1,417 to 1,431 bytes.  The virus will be located at the end of 
       infected programs.  There will be no change in the file date and 
       time in the disk directory. 
       Spanish April Fools activates if it becomes memory resident when 
       the system date is December 28th of any year.  Upon activation, 
       it will sporatically interfer with execution of some DOS internal 
       commands, such as COPY, RENAME, and DELETE.  These commands may not 
       function properly when they involve .EXE programs, either not 
       executing the command, or hanging the system. 

Show viruses from discovered during that infect .

Main Page