Holiday Virus

Virus Name: Holiday Aliases: V Status: Rare Discovered: October, 1993 Symptoms: .COM & .EXE growth; system hangs; Decrease in total system & available free memory Origin: Indonesia Eff Length: 2,900 - 2,916 Bytes Type Code: PRhAK - Resident Parasitic .COM Infector Detection Method: ViruScan, AVTK, F-Prot, IBMAV, Sweep, NAVDX, NAV, VAlert, PCScan, NShld, AVTK/N, NProt, Sweep/N, IBMAV/N, NAV/N, LProt Removal Instructions: Delete infected files General Comments: The Holiday virus was submitted in October, 1993, and is from Indonesia. Holiday is a memory resident infector of .COM and .EXE programs, including COMMAND.COM. When the first Holiday infected program is executed, this virus will install itself memory resident at the top of system memory but below the 640K DOS boundary, not moving interrupt 12's return. Total system and available free memory, as indicated by the DOS CHKDSK program, will have decreased by 2,912 bytes. Interrupt 21 will be hooked by Holiday in memory. Once the Holiday virus is memory resident, it will infect .COM and .EXE programs when they are executed. Infected .COM programs increase in size by 2,900 bytes while .EXE programs will have a file length increase of 2,906 to 2,916 bytes. In both cases, the virus will be located at the end of the file. The following text strings are visible within the viral code in all Holiday infected programs: "ATTENTION!" "I'm very sorry, today is my holiday." "So, I can't serve you, cause I want to play on your computers." "DON'T TURN OFF YOUR COMPUTER UNTIL TOMORROW," "OR YOUR DATA WILL BE LOST!!!" "I'll be back to serve you tomorrow." "Thank You," "AAA" "Thank You for playing, see you..." "Please, hit ENTER!" System hangs may occur when some infected programs are executed.