Type File virus
Creator Bumblebee
Date Discovered 2000
Place of Origin Madrid, Spain
Source Language Assembly
Platform MS Windows
File Type(s) .hlp
Infection Length

Ayuda, also known as Pluma is a Windows Help file virus. It was coded by Bumblebee in Spain and featured in issue 5 of 29A magazine.

Table of Contents


When a file infected with Ayuda is executed, the Windows Help system processes the virus code as a string. WinHlp32 allocates memory for the string and passes the memory address to the enum function.

Ayuda uses the CRC's for the API functions rather than their names. It adds its code to the SYSTEM area of the file.

The virus contains the following Spanish text:

< AYUDA! Coded by Bumblebee/29a >
Cumpliendo con mi oficio
piedra con piedra, pluma a pluma,
pasa el invierno y deja
sitios abandonados
habitaciones muertas:
yo trabajo y trabajo,
debo substituir tantos olvidos,
llenar de pan las tinieblas,
fundar otra vez la esperanza.

This translates to:

<AYUDA! Coded by Bumblebee / 29a >
Doing my job
stone by stone, quill by quill,
spends the winter and leaves
abandoned sites
dead rooms:
I work and work,
I have replaced many forgotten,
to fill bread(?) darkness
to find hope again.


"Ayuda" is Spanish for "Help". It was coded by Bumblebee in Madrid, Spain. Ayuda was published in Issue 5 of 29A magazine in December of 2000.


Bumblebee. 29A Magazine, AYUDA! 2000

Spyware32, WinHLP.Pluma.

Unless otherwise stated, the content of this page is licensed under Creative Commons Attribution-NonCommercial-ShareAlike 3.0 License