Spanish April Fools Virus

Virus Name: Spanish April Fools Aliases: December 28th V Status: Rare Discovered: June, 1991 Symptoms: .EXE file growth; TSR; system hangs; copy, delete, and rename commands may fail Origin: Spain Eff Length: 1,417 Bytes Type Code: PRsE - Parasitic Resident .EXE Infector Detection Method: ViruScan, AVTK, Sweep, F-Prot, NAV, PCScan, IBMAV, NAVDX, VAlert, ChAV, NShld, Sweep/N, Innoc, AVTK/N, LProt, IBMAV/N, NAV/N, NProt Removal Instructions: Delete infected files General Comments: The Spanish April Fools, or December 28th, virus was isolated in June, 1991, in the Zaragoza area of Spain. It is reported to be widespread in that area. Spanish April Fools is a memory resident infector of .EXE programs. When the first Spanish April Fools virus infected program is executed, the virus will install itself memory resident as a low system memory TSR of 1,808 bytes. Interrupts 21 and 28 will be hooked by the virus in memory. After Spanish April Fools has been memory resident for several minutes, it will start infecting .EXE programs when they are opened or executed. Infected .EXE programs will increase in size by 1,417 to 1,431 bytes. The virus will be located at the end of infected programs. There will be no change in the file date and time in the disk directory. Spanish April Fools activates if it becomes memory resident when the system date is December 28th of any year. Upon activation, it will sporatically interfer with execution of some DOS internal commands, such as COPY, RENAME, and DELETE. These commands may not function properly when they involve .EXE programs, either not executing the command, or hanging the system.