FANDOM


Virus.DOS.IDEA.6126 also referred as Spanska.6126, is a memory resident parasitic polymorphic encrypted DOS virus, written by Spanska from 29A.

This virus is also identified as Spanska by some antiviruses and it is the successor of Spanska_II.

Behavior

After the virus has been loaded into memory, it hooks INT 21h to infect any executable that is run, and it ignores files having the filename:

COMMAND VSAFE

The virus behaves stealthy and the infection size varies in different files, but the virus still can show absolutely no observable size change as it stores the size value in the infected files.

Advanced details

The TSR memory usage of the virus is 18,400 bytes.

MD5 hash:

84743bf74dd95541a0ddf4acffa6419f

Payload

When an infected program is run when the minute is equal to 30, and the second is less than or equal to 16, the virus activates with a video effect, by spinning two different colored texts is Matrix-styled.

Warning!
strong
crypto
inside

Other details

Files infected by Spanska_II may also be detected by IDEA, but it may still infect these files when run, as long as IDEA stays in memory.

The virus contains the internal text strings:

IDEA virus (c) Spanska 98
Thx to Rajaat (poly), F Mirza (IDEA), Wild Worker (zip), Solar D (road)

See also

Ad blocker interference detected!


Wikia is a free-to-use site that makes money from advertising. We have a modified experience for viewers using ad blockers

Wikia is not accessible if you’ve made further modifications. Remove the custom ad blocker rule(s) and the page will load as expected.