Spanska viruses  
------------------------

This little collection contains all the viruses
released by Spanska for the moment (April 1997). 
They are simple, but beat quasi all antivirus 
heuristic scanning at the moment they are written.
They are not destructive, just display from time
to time a graphic payload.
The files are, in chronologic order:

********************* NO PASARAN VIRUS ******************************

nopsrn1.com:
First version of the NoPasaran (1120 bytes, encrypted, .com non-TSR)
Called Spanska.1120 by AV people
Remarks: infects 7 files going up until the root, than in "level 1" 
subdirectories (not command.com). Signature: "lb". Payload activation 
when min=22 and sec<30

nopsrn2.com:
Second version of the NoPasaran (1000 bytes, encrypted, .com non-TSR)
Called Spanska.1000 by AV people
Remarks: idem version 1, but signature is "lc".

nopsrn-g.com:
Not a virus. Just the graphic effect of the NoPasaran virus
(a message in memory of the guys killed in Spain during the Spanish
Civil War 1936-1939 when they fighted against fascism, with two fire
effects)

********************* COSMOS VIRUS **********************************

cosmos.com:
The Cosmos virus (1120 bytes, encrypted, .com non-TSR)
Called Spanska.1120.B by AV people
Remarks: infects 6 files going up until the root, than in "level 1" 
subdirectories (not command.com). Does not infect if it is in the root,
or files infected with NoPasaran. Scans CRC files from TBAV and MSAV 
to modify names of infected files. Signature: "aa". Payload activation 
when min=52 and sec<20

cosmos-g.com:
Not a virus. Just the graphic effect of the Cosmos virus
(a message in memory of Carl Sagan, an famous astrophysician who 
showed me that hard science can be mixed with poetry, history, 
philosophy and humanism, with a starfield effect)

********************* MARS VIRUS ************************************

mars.com:
The Mars virus (1500 bytes, encrypted, .com/.exe non-TSR)
Will be called Spanska.1500 by AV people (i guess...)
Remarks: infects 3 .com and 3 .exe files going up until the root, 
than in "level 1" subdirectories (not command.com). Signature: "ee". 
Payload activation when min=30 and sec<30

mars-g.com:
Not a virus. Just the graphic effect of the Mars virus
(a 3D voxel effect that looks like a moving Mars landscape, with 
some imagination of course...)

Well, for the moment, that's all folks...
Spanska.

