Spanish Virus

Virus Name: Spanish Aliases: V Status: Rare Discovered: August, 1991 Symptoms: .COM & .EXE growth; TSR; slow program loads; cascading letters graphic effect with system hang Origin: Spain Eff Length: 2,930 Bytes Type Code: PRsAK - Parasitic Resident .COM & .EXE Infector Detection Method: ViruScan, F-Prot, Sweep, NAV, AVTK, IBMAV, NAVDX, VAlert, PCScan, ChAV, NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N Removal Instructions: Delete infected files General Comments: The Spanish virus was discovered in Spain in August, 1991. Spanish is a memory resident generic file infector which is very similar to the Traceback II virus. The first time a program infected with Spanish is executed, Spanish will install itself memory resident as a low system memory TSR of 7,632 bytes. Interrupts 1C, 20, 21, and 27 will be hooked by the virus in memory. COMMAND.COM will also be infected at this time. Once memory resident, each time a program is executed, the virus will infect the program the user is attempting to execute, along with one additional .COM program in the current directory. Spanish infected programs will increase in size by 2,930 bytes. The virus will be located at the end of the infected program. There will be no change in the file's date and time in the DOS disk directory. A symptom of a Spanish infection is that program loads will take longer when the user attempts to execute a program. The slowdown is due to the virus searching the current directory for a candidate file to infect. After Spanish is memory resident for one hour, it will display a cascading screen effect similar to the Traceback II virus. The characters on the system display will fall to the bottom of the screen, until they encounter another character. Unlike Traceback II, the screen is not restored by the virus, and the system will end up being hung. See: Traceback II