Happy Virus

Virus Name: Happy Aliases: V Status: Rare Discovered: July, 1992 Symptoms: .COM file growth; file date/time change; message Origin: Unknown Eff Length: 412 Bytes Type Code: PNCK - Parasitic Non-Resident .COM Infector Detection Method: AVTK, Sweep, ViruScan, F-Prot, IBMAV, NAV, NAVDX, VAlert, PCScan, ChAV, NShld, Sweep/N, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N, LProt Removal Instructions: Delete infected files General Comments: The Happy virus was submitted in July, 1992. Its origin or point of isolation is unknown. Happy is a non-resident, direct action infector of .COM programs, including COMMAND.COM. When a program infected with the Happy virus is executed, the Happy virus will infect one .COM file in the current directory, as well as one .COM file in the C:\DOS directory. The following message will then be displayed: "Thank you for running the Happy virus Warning !!! COM-files in current directory and C:\DOS might be infected !!!!" Programs infected with the Happy virus will have a file length increase of 412 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory listing will have been updated to the current system date and time when infection occurred. The message text indicated above can be seen within the viral code in all Happy infected programs. The first byte of Happy infected programs will be a hex "FF" character, which is the virus' infection marker.