Virus Name: Vinchuca
V Status: New
Discovered: April, 1994
Symptoms: .COM file growth; TSR
Eff Length: 925 Bytes
Type Code: PRsC - Parasitic Resident .COM Infector
Detection Method: AVTK, ViruScan, IBMAV, F-Prot, NAV, Sweep,
NAVDX, VAlert, PCScan, ChAV,
IBMAV/N, NShld, AVTK/N, Sweep/N, NAV/N, NProt, Innoc 4.0+
Removal Instructions: Delete infected files
The Vinchuca virus was received in April, 1994, and is from
Argentina. It is a memory resident infector of .COM programs,
but not COMMAND.COM.
When the first Vinchuca infected program is executed, this virus
will install itself memory resident as a low system memory TSR
of 1,232 bytes. Interrupt 21 will be hooked by the virus in
Once the Vinchuca virus is memory resident, it will infect .COM
programs when they are executed. Infected programs will have a
file length increase of 925 bytes with the virus being located
at the beginning of the file. The program's date and time in the
DOS disk directory listing will not be altered. The following
text strings are encrypted within the Vinchuca viral code:
"Saludos para SaTaNiC BRaiN y Patoruzu"
"Virus ViNCHuCa V1.0 1993"
"Creado por MURDOCK."
"Su PC tiene Mal de Chagas....jajaja..."