Virus Name: Spanish
V Status: Rare
Discovered: August, 1991
Symptoms: .COM & .EXE growth; TSR; slow program loads;
cascading letters graphic effect with system hang
Eff Length: 2,930 Bytes
Type Code: PRsAK - Parasitic Resident .COM & .EXE Infector
Detection Method: ViruScan, F-Prot, Sweep, NAV, AVTK, IBMAV,
NAVDX, VAlert, PCScan, ChAV,
NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N,
Removal Instructions: Delete infected files
The Spanish virus was discovered in Spain in August, 1991. Spanish
is a memory resident generic file infector which is very similar
to the Traceback II virus.
The first time a program infected with Spanish is executed, Spanish
will install itself memory resident as a low system memory TSR of
7,632 bytes. Interrupts 1C, 20, 21, and 27 will be hooked by the
virus in memory. COMMAND.COM will also be infected at this time.
Once memory resident, each time a program is executed, the virus will
infect the program the user is attempting to execute, along with one
additional .COM program in the current directory. Spanish infected
programs will increase in size by 2,930 bytes. The virus will be
located at the end of the infected program. There will be no change
in the file's date and time in the DOS disk directory.
A symptom of a Spanish infection is that program loads will take
longer when the user attempts to execute a program. The slowdown
is due to the virus searching the current directory for a candidate
file to infect.
After Spanish is memory resident for one hour, it will display a
cascading screen effect similar to the Traceback II virus. The
characters on the system display will fall to the bottom of the
screen, until they encounter another character. Unlike Traceback
II, the screen is not restored by the virus, and the system will
end up being hung.
See: Traceback II