Fandom

Malware Wiki

IDEA

1,335pages on
this wiki
Add New Page
Comments0 Share

Virus.DOS.IDEA.6126, or Spanska.6126, is a memory resident parasitic polymorphic encrypted DOS virus, written by Spanska from 29A.

This virus is also identified as Spanska by some antiviruses and it is the successor of Spanska_II.

Behavior

After the virus has been loaded into memory, it hooks INT 21h to infect any executable that is run, and it ignores files having the filename:

COMMAND VSAFE

The virus behaves stealthy and the infection size varies in different files, but the virus still can show absolutely no observable size change as it stores the size value in the infected files.

Memory usage

The exact memory usage is 18,400 bytes.

Payload

When an infected program is run when the minute is equal to 30, and the second is less than or equal to 16, the virus activates with a video effect, by spinning two different colored texts is Matrix-styled.

Warning!
strong
crypto
inside

Other details

Files infected by Spanska_II may also be detected by IDEA, but it may still infect these files when run, as long as IDEA stays in memory.

The virus contains the internal text strings:

IDEA virus (c) Spanska 98
Thx to Rajaat (poly), F Mirza (IDEA), Wild Worker (zip), Solar D (road)

See also

Ad blocker interference detected!


Wikia is a free-to-use site that makes money from advertising. We have a modified experience for viewers using ad blockers

Wikia is not accessible if you’ve made further modifications. Remove the custom ad blocker rule(s) and the page will load as expected.