FANDOM


The No Pasaran variant of Spanska is a parasitic encrypted virus on DOS. It is written by Spanska from 29A.

There are 3 variants in this version:

  • Virus.DOS.Spanska.1000
  • Virus.DOS.Spanska.1008
  • Virus.DOS.Spanska.1120.a

BehaviorEdit

First 7 uninfected DOS executable files will be infected when the virus is run.

Spanska.1120.a is the initial release in 1996, which contains bugs that might hang the system during execution, but not in those infected files. Spanska.1000 and 1008 are the "version 2" as stated in the payload, as they fixed some bugs since the 1,120-byte variant.

Advanced detailsEdit

These variants do not stay memory resident after an execution.

MD5 hashes:

Variant Hash
Spanska.1000 31d049c63ac02e5a157c1ae8939be4ec
Spanska.1008 1fa3d9434f9f8ced053947c4129584cf
Spanska.1120.a eae30c3ae4c4d00369b3198f9fb30a5a

PayloadEdit

When an infected file is run at the time which the minute equals to 22 and the second is less than 30, the virus activates with a video effect of two flame animations at the lower corners.

Spanska.1000 and 1008Edit

These variants displays the messages in sequence:

Remember those who died for Madrid
No Pasaran! Virus v2 by Spanska 1997

Spanska.1120.aEdit

This variant is an earlier release, it displays the messages in sequence:

Remember those who died for Madrid
No Pasaran! Virus (c) Spanska 1996
Spanska1000 payload1

The first message in the payload.

Other detailsEdit

Spanska.1120.b, having the same infection size, but it contains different payload and activates at different time.

Did you know?Edit

The phrase "No Pasaran!" ("They shall not pass!") refers to a famous speech given by Dolores Ibarruri, a Spanish freedom fighter. It was appeared in her radio speech in 1936.

ReferencesEdit

  1. Description of Spanska on F-Secure Labs

See alsoEdit

Ad blocker interference detected!


Wikia is a free-to-use site that makes money from advertising. We have a modified experience for viewers using ad blockers

Wikia is not accessible if you’ve made further modifications. Remove the custom ad blocker rule(s) and the page will load as expected.