Virus Name: Avispa
V Status: Rare
Discovery: February, 1994
Symptoms: .EXE file growth; TSR; file date/time seconds = "00"
Eff Length: 2,048 - 2,062 Bytes
Type Code: PRsE - Parasitic Resident .EXE Infector
Detection Method: AVTK, IBMAV, Sweep, NAV, ViruScan, F-Prot, NAVDX,
VAlert, PCScan, ChAV,
AVTK/N, Sweep/N, IBMAV/N, NProt, NAV/N, NShld, Innoc
Removal Instructions: Delete infected files
The Avispa virus was received in February, 1994, and is from
Argentina. This virus is a memory resident infector of .EXE
When the first Avispa infected program is executed, this virus
will install itself memory resident as a low system memory TSR of
2,304 bytes. Interrupt 13 and 21 will be hooked by the virus in
Once the Avispa virus is memory resident, it may infect .EXE
programs when they are executed. Infected programs will have a
file length increase of 2,048 to 2,062 bytes with the virus being
located at the end of the file. The program's date and time in
the DOS disk directory listing will appear to be unaltered, though
the seconds field will have been set to "00". The following text
strings are encrypted within the Avispa viral code:
"__ Virus Avispa - Buenos Aires - Noviembre 1993 __"
"$$ Virus AVISPA $$ Republica Argentina$$ Elijah Baley $$
Noviembre 10 de 1993 $$"
"This program is not an old virus variant, and it was
written in Argentina by Elijah Baley."
"It uses polymorphic technics to avoid conventional
"MENEM: Libertador de torturadores y asesinos de inocentes,
que Dios se apiade de tu pobre alma. $$"
It is unknown what Avispa does besides replicate.