Fandom

Malware Wiki

Spanska (Mars Land variant)

1,335pages on
this wiki
Add New Page
Comments0 Share

Spanska (Mars Land) is a parasitic encrypted DOS virus, written by Spanska form 29A.

There are 3 variants in this version:

  • Virus.DOS.Spanska.1474
  • Virus.DOS.Spanska.1500
  • Virus.DOS.Spanska.1509

Behavior

When the virus is run, it infects first 3 uninfected DOS and EXE executable in the current directory, i.e. 6 files are infected on each run.

The virus does not infect COMMAND.COM and files that are smaller than 600 bytes.

Payload

The virus activates when the minute is equal to 30, and the second is less than or equal to 30. It displays a high quality payload of a Mars-esque surface scrolling by and captions. For its time, it was considered to be a high quality modeling, but by today's standards, this is considered to be low quality.

Spanska.1474 displays the caption:

SPANSKA PresentMars L
Mars Landing|μ♥  *.* *.C* *.E* .

The later part of the caption (containing garbage letters and filename extensions) is expected not to be shown.

Spanska.1500 and 1509 are the bug fixing releases since Spanska.1474, they display the caption:

Mars Land, by Spanska
(coding a virus can be creative)
Spanska1474 payload

Payload screen of Spanska.1474

Other details

The virus contains the internal text string:

*.* *.C* *.E*

References

Description of Spanska, F-Secure Lab

See also

Videos

Spanska DOS Virus00:46

Spanska DOS Virus

Spanska (Mars landing) virus review by danooct1

Virus.DOS.Spanska01:30

Virus.DOS.Spanska.1500-0

Spanska (Mars landing) virus review by Alles Sandro

Ad blocker interference detected!


Wikia is a free-to-use site that makes money from advertising. We have a modified experience for viewers using ad blockers

Wikia is not accessible if you’ve made further modifications. Remove the custom ad blocker rule(s) and the page will load as expected.