This virus is also identified as Spanska by some antiviruses and it is the successor of Spanska_II.
After the virus has been loaded into memory, it hooks INT 21h to infect any executable that is run, and it ignores files having the filename:
The virus behaves stealthy and the infection size varies in different files, but the virus still can show absolutely no observable size change as it stores the size value in the infected files.
The TSR memory usage of the virus is 18,400 bytes.
When an infected program is run when the minute is equal to 30, and the second is less than or equal to 16, the virus activates with a video effect, by spinning two different colored texts is Matrix-styled.
strong crypto inside
Files infected by Spanska_II may also be detected by IDEA, but it may still infect these files when run, as long as IDEA stays in memory.
The virus contains the internal text strings:
IDEA virus (c) Spanska 98 Thx to Rajaat (poly), F Mirza (IDEA), Wild Worker (zip), Solar D (road)