Spanska (Mars Land) is a parasitic encrypted DOS virus, written by Spanska form 29A.

There are 3 variants in this version:

  • Virus.DOS.Spanska.1474
  • Virus.DOS.Spanska.1500
  • Virus.DOS.Spanska.1509


When the virus is run, it infects first 3 uninfected executable files in both COM and EXE formats in current directory, i.e. 6 files are infected on each run.

The virus does not infect COMMAND.COM and files that are smaller than 600 bytes.

Advanced details

These viruses do not stay memory resident.

MD5 hashes:

Variant Hash
Spanska.1474 1379086e28885b177e785ffbe4eb990e
Spanska.1500 2c5736d19cd8d9375a25766bc5279373
Spanska.1509 8c80da330283a7631d9d4bddca38dd12


The virus activates when the minute is equal to 30, and the second is less than or equal to 30. It displays a high quality payload of a Mars-esque surface scrolling by and captions. For its time, it was considered to be a high quality modeling, but by today's standards, this is considered to be low quality.

Spanska.1474 displays the caption:

SPANSKA PresentMars L
Mars Landing|μ♥  *.* *.C* *.E* .

The later part of the caption (containing garbage letters and filename extensions) is expected not to be shown.

Spanska.1500 and 1509 are the bug fixing releases since Spanska.1474, they display the caption:

Mars Land, by Spanska
(coding a virus can be creative)
Spanska1474 payload

Payload screen of Spanska.1474

Other details

The virus contains the internal text string:

*.* *.C* *.E*


  1. Description of Spanska on F-Secure Lab

See also


Spanska DOS Virus

Spanska DOS Virus

Spanska (Mars landing) virus review by danooct1



Spanska (Mars landing) virus review by Alles Sandro