FANDOM


Spanska (Mars Land) is a parasitic encrypted DOS virus, written by Spanska form 29A.

There are 3 variants in this version:

  • Virus.DOS.Spanska.1474
  • Virus.DOS.Spanska.1500
  • Virus.DOS.Spanska.1509

BehaviorEdit

When the virus is run, it infects first 3 uninfected executable files in both COM and EXE formats in current directory, i.e. 6 files are infected on each run.

The virus does not infect COMMAND.COM and files that are smaller than 600 bytes.

MD5 hashesEdit

You can obtain information by checking the MD5 hash codes.

Variant Hash
Spanska.1474 1379086e28885b177e785ffbe4eb990e
Spanska.1500 2c5736d19cd8d9375a25766bc5279373
Spanska.1509 8c80da330283a7631d9d4bddca38dd12

PayloadEdit

The virus activates when the minute is equal to 30, and the second is less than or equal to 30. It displays a high quality payload of a Mars-esque surface scrolling by and captions. For its time, it was considered to be a high quality modeling, but by today's standards, this is considered to be low quality.

Spanska.1474 displays the caption:

SPANSKA PresentMars L
Mars Landing|μ♥  *.* *.C* *.E* .

The later part of the caption (containing garbage letters and filename extensions) is expected not to be shown.

Spanska.1500 and 1509 are the bug fixing releases since Spanska.1474, they display the caption:

Mars Land, by Spanska
(coding a virus can be creative)
Spanska1474 payload

Payload screen of Spanska.1474

Other detailsEdit

The virus contains the internal text string:

*.* *.C* *.E*

ReferencesEdit

  1. Description of Spanska on F-Secure Lab

See alsoEdit

VideosEdit

Spanska DOS Virus00:46

Spanska DOS Virus

Spanska (Mars landing) virus review by danooct1

Virus.DOS.Spanska01:30

Virus.DOS.Spanska.1500-0

Spanska (Mars landing) virus review by Alles Sandro

Ad blocker interference detected!


Wikia is a free-to-use site that makes money from advertising. We have a modified experience for viewers using ad blockers

Wikia is not accessible if you’ve made further modifications. Remove the custom ad blocker rule(s) and the page will load as expected.