Ayuda

Ayuda
Type	File virus
Creator	Bumblebee
Date Discovered	2000
Place of Origin	Madrid, Spain
Source Language	Assembly
Platform	MS Windows
File Type(s)	.hlp
Infection Length

Ayuda, also known as Pluma is a Windows Help file virus. It was coded by Bumblebee in Spain and featured in issue 5 of 29A magazine.

Behavior

When a file infected with Ayuda is executed, the Windows Help system processes the virus code as a string. WinHlp32 allocates memory for the string and passes the memory address to the enum function.

Ayuda uses the CRC's for the API functions rather than their names. It adds its code to the SYSTEM area of the file.

The virus contains the following Spanish text:

< AYUDA! Coded by Bumblebee/29a >
Cumpliendo con mi oficio
piedra con piedra, pluma a pluma,
pasa el invierno y deja
sitios abandonados
habitaciones muertas:
yo trabajo y trabajo,
debo substituir tantos olvidos,
llenar de pan las tinieblas,
fundar otra vez la esperanza.

This translates to:

<AYUDA! Coded by Bumblebee / 29a >
Doing my job
stone by stone, quill by quill,
spends the winter and leaves
abandoned sites
dead rooms:
I work and work,
I have replaced many forgotten,
to fill bread(?) darkness
to find hope again.

Origin

"Ayuda" is Spanish for "Help". It was coded by Bumblebee in Madrid, Spain. Ayuda was published in Issue 5 of 29A magazine in December of 2000.

Sources

Bumblebee. 29A Magazine, AYUDA! 2000

Spyware32, WinHLP.Pluma.