Avispa Virus

Virus Name: Avispa Aliases: V Status: Rare Discovery: February, 1994 Symptoms: .EXE file growth; TSR; file date/time seconds = "00" Origin: Argentina Eff Length: 2,048 - 2,062 Bytes Type Code: PRsE - Parasitic Resident .EXE Infector Detection Method: AVTK, IBMAV, Sweep, NAV, ViruScan, F-Prot, NAVDX, VAlert, PCScan, ChAV, AVTK/N, Sweep/N, IBMAV/N, NProt, NAV/N, NShld, Innoc Removal Instructions: Delete infected files General Comments: The Avispa virus was received in February, 1994, and is from Argentina. This virus is a memory resident infector of .EXE programs. When the first Avispa infected program is executed, this virus will install itself memory resident as a low system memory TSR of 2,304 bytes. Interrupt 13 and 21 will be hooked by the virus in memory. Once the Avispa virus is memory resident, it may infect .EXE programs when they are executed. Infected programs will have a file length increase of 2,048 to 2,062 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory listing will appear to be unaltered, though the seconds field will have been set to "00". The following text strings are encrypted within the Avispa viral code: "__ Virus Avispa - Buenos Aires - Noviembre 1993 __" "$$ Virus AVISPA $$ Republica Argentina$$ Elijah Baley $$ Noviembre 10 de 1993 $$" "This program is not an old virus variant, and it was written in Argentina by Elijah Baley." "It uses polymorphic technics to avoid conventional scanning." "MENEM: Libertador de torturadores y asesinos de inocentes, que Dios se apiade de tu pobre alma. $$" It is unknown what Avispa does besides replicate.