Virus.DOS.Arriba is a memory resident parasitic virus on DOS.

There are 2 variants:

  • Virus.DOS.Arriba.1590 (A and B)


When the virus is loaded into memory, it hooks INT 21h and 24h to infect any executable that is run.

The virus behaves stealthy when MEM is run so that the actual memory comsumption of the virus will not be shown, but the size change of the infected files is still visible.

Advanced details

The TSR memory usage of the variants:

Variant Memory usage in bytes
Arriba.1590 (A and B) 9,000

MD5 hashes:

Variant Hash
Arriba.1590.a 19ae67db93e0187fef91e90ce8dc2b99
Arriba.1590.b c091f40601775e7e6afec0c1b5d63f78


This variant activates on November 20. It displays a marquee in high speed, followed by hanging the system:

Cara al sol con la camisa nueva
que tu bordaste rojo ayer
hallaras la muerte si te llega
y no te vuelvo a ver
formare junto a mis compañeros
que hacen guardia sobre los luceros
impasible el ademan y están presentes
en nuestro afan
si te dicen que cai me fui al puesto que tengo alli
volveran banderas victoriosas al paso alegre
de la paz y seran prendidas cinco rosas las flechas de mi paz
volvera a reir la primavera que por cielo y tierra y mar
esperan arriba a España y a vencer, que en España empieza
20-N-90 Spain Jaws & Shark ARRIBA ESPAÑA

Translation (from Spanish):

Face to the sun with the new shirt
the userr red embroider on yesterday
the user will find death if it comes to the user
And I never see the user again
I will train with my partners
Who stand guard over the stars
Impassible motion and are present
In our eagerness
If they tell the user to fall I went to the post I have there
Will return victorious flags to the merry step
Of peace and five roses will be caught the arrows of my peace
Spring will laugh again than by sky and land and sea
They wait up to Spain and to overcome, that in Spain begins


This variant activates on May 19, it would also display a marquee but failed:

Tres Anillos para los Reyes Elfos bajo el cielo.
Siete para los Señores Enanos en palacios de piedra.
Nueve para los Hombres Mortales condenados a morir.
Uno para el Señor Oscuro sobre el trono oscuro en la Tierra de Mordor donde se extienden las Sombras.
Un Anillo para gobernarlos a todos.
Un Anillo para encontrarlos, un Anillo para atraerlos a todos y atarlos en las tinieblas en la Tierra de Mordor donde se extienden las Sombras.
Extracto de "El Señor de los Anillos" de J.R.R. TOLKIEN. 1955
Virus Tolkien vK&S. (c) IMV, STi, K&S 1995.
Created in Chiba City. The Spock's Mutation Factory are the fast in the world. We are professionals. Thanks to Central Point for their PC Tools Deluxe R4.20. Use the userr Debugger.

Translation (from Spanish):

Three Rings for the Elven Kings under the sky.
Seven for the Dwarf Lords in stone palaces.
Nine for the mortal men doomed to die.
One for the Dark Lord on the dark throne in the Land of Mordor where the Shadows extend.
One Ring to rule them all.
A Ring to find them, a Ring to lure them all and tie them in the darkness in the Land of Mordor where the Shadows extend.
Extract from "The Lord of the Rings" by J.R.R. TOLKIEN. 1955
The rest are in English

Other details

According to the text strings in Arriba.1590.b, debugging is required in order to activate the payload.



Arriba.Arriba -Arriba DOS Virus-

Arriba virus review by Alles Sandro