| Spanska | |
|---|---|
| Type | File virus |
| Creator | Spanska |
| Date Discovered | 1996 |
| Place of Origin | France |
| Source Language | Assembly |
| Platform | DOS |
| File Type(s) | .com, .exe |
| Infection Length | 1,120 bytes |
Spanska is a family of closely -related viruses by an author of the same name. They are mostly harmless and do little more than display messages or graphics.
Behavior
When a file infected with Spanska is executed, the virus decrypts itself and looks for a file to infect in the current directory. It appends its 1,120 bytes to the end of the file and encrypts it. Spanska has a payload between 22 minutes and 22 minutes 30 seconds after the hour. It displays a message with text that alternates every second saying "Remember those who died for Madrid" and "No Pasaran! Virus (c) Spanska 1996". At the bottom are two animated torches on opposite ends of the screen.
 |
|
| Spanska.NoPasaran |
|---|
Variants
There is a 1,000 byte variant that behaves identically to the original. There is also another 1,120 byte variant that has a payload which triggers between 52 minutes and 52 minutes 20 seconds past every hour. It displays the message "To Carl Sagan poet and scientist, this little Cosmos. (Spanska 97)" with passing stars in the background. Some researchers consider Elvira to be a variant of Spanska, however it is nearly four times the size of the original and has a few functionalities the others do not.
Origin
Spanska was coded in France by an author of the same name. It was coded in Assembly. The variants take inspiration from people and things of interest to its author. Notably, the phrase "No Pasaran" or "they (the Francoists) shall not pass" comes from a speech by Dolores Ibarruri given in 1936 during the Spanish civil war. Though the communist Republicans won the battle and did not allow the Francoists to pass, they ultimately lost the war.
Effects
Some Spanska variants were put on newsgroups in April of 1997, including alt.cracks, alt.2600.codez, alt.crackers, alt.2600, alt.2600.crackz, alt.sex, alt.2600.hackerz, alt.irc, and alt.warez.ibm-pc. It was reported wild in September of that year. Some researchers speculate it would have never gone wild without first being seeded on the Internet.
Sources
The Virus Bulletin, May 1997. pg 5
F-Secure, Spanska.
| The Cosmos variant in action |
|---|
| The Mars Land variant in action |
|---|