Arale Virus

 Virus Name:  Arale 
 V Status:    Rare 
 Discovery:   February, 1994 
 Symptoms:    .COM & .EXE growth; TSR; 
              message displayed with return to DOS prompt 
 Origin:      Spain 
 Eff Length:  1,526 - 1,541 Bytes 
 Type Code:   PRsA - Parasitic Resident .COM & .EXE Infector 
 Detection Method:  ViruScan, F-Prot, AVTK, IBMAV, Sweep, NAV, 
                    NAVDX, VAlert, PCScan, ChAV, 
                    NShld, Sweep/N, IBMAV/N, AVTK/N, Innoc, NProt, NAV/N 
 Removal Instructions:  Delete infected files 
 General Comments: 
       The Arale virus was received in February, 1994.  It is from Spain. 
       Arale is a memory resident infector of .COM and .EXE programs, but 
       not COMMAND.COM.  It displays a message on seven days during the 
       When the first Arale infected program is executed, this virus will 
       install itself memory resident as a low system memory TSR of 1,984 
       bytes.  Interrupt 21 will be hooked by the Arale virus in memory. 
       Once memory resident, the Arale virus will infect .COM and .EXE 
       programs when they are executed.  Infected programs will have a 
       file length increase of 1,526 to 1,541 bytes with the virus being 
       located at the end of the file.  The program's date and time in the 
       DOS disk directory listing will not be altered.  The following text 
       strings are visible within the viral code in all Arale infected 
               "Maite C. P." 
               "Roberto R. I." 
               "Elsa B. E." 
               "Esther F. P." 
               "Carol C. B." 
               "David M. E." 
               "Anselmo B. V." 
               "(P) 1993 by Arale & Goku Corp." 
       The above text strings are used by the virus to display the following 
       two line message when the virus activates on seven days of the year: 
                (P) 1993 by Arale & Goku Corp." 
       The "" characters will be the text string indicated below 
       for the particular activation date: 
               March 14th    : "Elsa B. E." 
               April 28th    : "Roberto R. I." 
               May 13th      : "Anselmo B. V." 
               May 17th      : "David M. E." 
               June 12th     : "Carol C. B." 
               July 15th     : "Esther F. P." 
               December 12th : "Maite C. P." 
       Arale activates when the user executes a program on one of the above 
       dates.  The two line message is displayed, and the user is then 
       returned to the DOS prompt. 

Show viruses from discovered during that infect .

Main Page