Japanese Christmas Virus
Virus Name: Japanese Christmas
Aliases: Christmas In Japan, Japan
V Status: Rare
Discovery: September, 1989
Symptoms: .COM file growth; message
Origin: Japan
Eff Length: 600 Bytes
Type Code: PNCK - Parasitic Non-Resident .COM Infector
Detection Method: ViruScan, AVTK, F-Prot, NAV, Sweep,
IBMAV, NAVDX, VAlert, PCScan, ChAV,
NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N,
NAV/N, IBMAV/N
Removal Instructions: Delete infected files
General Comments:
The Japanese Christmas virus was first reported in Japan in
September, 1989. It was later isolated in Japan in late
September, 1990. As of October, 1990, it was reported to be
widespread in Japan. This virus is a 600 byte non-resident generic
infector of .COM files. It will infect COMMAND.COM.
When a program infected with the Japanese Christmas virus is
executed, the virus will infect zero to one other .COM file in the
current directory. If a file is infected, it will increase in
length by 600 bytes, with the virus being located at the end of the
infected file.
On December 25th, if an infected file is executed, the following
message will be displayed in the center of the screen:
"A merry christmas to you"
The message will flash and will be underlined for approximately half
the time it is displayed. If left alone, the message will go away
after a little while and the program will execute normally, but the
message will return when another infected .COM file is executed.
This virus does not appear to do any malicious damage.
Known Variant(s) of Japanese Christmas are:
Japanese-709: Received in October, 1992, Japanese-709 or
DAPDM-13 is a 709 byte variant of the Japanese Christmas
virus described above. It infects one .COM file each time
an infected program is executed. Infected programs will have
a file length increase of 709 bytes with the virus being
located at the end of the file. The file's date and time
will not be altered. Two text strings can be found within
the viral code in infected files:
"*.*"
"PATH=*.COM"
Origin: Japan October, 1992.
Japanese Christmas-B: Functionally similar to the original virus,
Japanese Christmas-B is a minor variant with some code
modifications.
Origin: Japan October, 1992.
Japanese Christmas-C: Functionally similar to the original virus,
Japanese Christmas-C is a minor variant with some code
modifications.
Origin: Japan October, 1992.
Japanese Christmas-D: Functionally similar to the original virus,
Japanese Christmas-D is a minor variant with some code
modifications.
Origin: Japan October, 1992.
Japanese Cookie: Received in April, 1992, this variant infects
one .COM program in the current directory whenever an
infected program is executed. Infected programs will have
a file length increase of 653 bytes with the virus being
located at the end of the file. The program's date and time
in the DOS disk directory listing will not have been
altered. The only text string visible in the viral code
in infected programs is "*.com".
Origin: Japan April, 1992.