Arale Virus
Virus Name: Arale
Aliases:
V Status: Rare
Discovery: February, 1994
Symptoms: .COM & .EXE growth; TSR;
message displayed with return to DOS prompt
Origin: Spain
Eff Length: 1,526 - 1,541 Bytes
Type Code: PRsA - Parasitic Resident .COM & .EXE Infector
Detection Method: ViruScan, F-Prot, AVTK, IBMAV, Sweep, NAV,
NAVDX, VAlert, PCScan, ChAV,
NShld, Sweep/N, IBMAV/N, AVTK/N, Innoc, NProt, NAV/N
Removal Instructions: Delete infected files
General Comments:
The Arale virus was received in February, 1994. It is from Spain.
Arale is a memory resident infector of .COM and .EXE programs, but
not COMMAND.COM. It displays a message on seven days during the
year.
When the first Arale infected program is executed, this virus will
install itself memory resident as a low system memory TSR of 1,984
bytes. Interrupt 21 will be hooked by the Arale virus in memory.
Once memory resident, the Arale virus will infect .COM and .EXE
programs when they are executed. Infected programs will have a
file length increase of 1,526 to 1,541 bytes with the virus being
located at the end of the file. The program's date and time in the
DOS disk directory listing will not be altered. The following text
strings are visible within the viral code in all Arale infected
programs:
"FELICIDADES:"
"Maite C. P."
"Roberto R. I."
"Elsa B. E."
"Esther F. P."
"Carol C. B."
"David M. E."
"Anselmo B. V."
"(P) 1993 by Arale & Goku Corp."
"COMMAND.COM"
The above text strings are used by the virus to display the following
two line message when the virus activates on seven days of the year:
"FELICIDADES: ‘‘‘‘‘‘‘‘
(P) 1993 by Arale & Goku Corp."
The "‘‘‘‘‘‘‘‘" characters will be the text string indicated below
for the particular activation date:
March 14th : "Elsa B. E."
April 28th : "Roberto R. I."
May 13th : "Anselmo B. V."
May 17th : "David M. E."
June 12th : "Carol C. B."
July 15th : "Esther F. P."
December 12th : "Maite C. P."
Arale activates when the user executes a program on one of the above
dates. The two line message is displayed, and the user is then
returned to the DOS prompt.