|Place of Origin||Madrid, Spain|
Ayuda, also known as Pluma is a Windows Help file virus. It was coded by Bumblebee in Spain and featured in issue 5 of 29A magazine.
When a file infected with Ayuda is executed, the Windows Help system processes the virus code as a string. WinHlp32 allocates memory for the string and passes the memory address to the enum function.
Ayuda uses the CRC's for the API functions rather than their names. It adds its code to the SYSTEM area of the file.
The virus contains the following Spanish text:
< AYUDA! Coded by Bumblebee/29a > Cumpliendo con mi oficio piedra con piedra, pluma a pluma, pasa el invierno y deja sitios abandonados habitaciones muertas: yo trabajo y trabajo, debo substituir tantos olvidos, llenar de pan las tinieblas, fundar otra vez la esperanza.
This translates to:
<AYUDA! Coded by Bumblebee / 29a > Doing my job stone by stone, quill by quill, spends the winter and leaves abandoned sites dead rooms: I work and work, I have replaced many forgotten, to fill bread(?) darkness to find hope again.
Bumblebee. 29A Magazine, AYUDA! 2000