Japanese Christmas Virus


 Virus Name:  Japanese Christmas 
 Aliases:     Christmas In Japan, Japan 
 V Status:    Rare 
 Discovery:   September, 1989 
 Symptoms:    .COM file growth; message 
 Origin:      Japan 
 Eff Length:  600 Bytes 
 Type Code:   PNCK - Parasitic Non-Resident .COM Infector 
 Detection Method:  ViruScan, AVTK, F-Prot, NAV, Sweep, 
                    IBMAV, NAVDX, VAlert, PCScan, ChAV, 
                    NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, 
                    NAV/N, IBMAV/N 
 Removal Instructions:  Delete infected files 
 
 General Comments: 
       The Japanese Christmas virus was first reported in Japan in 
       September, 1989.  It was later isolated in Japan in late 
       September, 1990.  As of October, 1990, it was reported to be 
       widespread in Japan.  This virus is a 600 byte non-resident generic 
       infector of .COM files.  It will infect COMMAND.COM. 
 
       When a program infected with the Japanese Christmas virus is 
       executed, the virus will infect zero to one other .COM file in the 
       current directory.  If a file is infected, it will increase in 
       length by 600 bytes, with the virus being located at the end of the 
       infected file. 
 
       On December 25th, if an infected file is executed, the following 
       message will be displayed in the center of the screen: 
 
               "A merry christmas to you" 
 
       The message will flash and will be underlined for approximately half 
       the time it is displayed.  If left alone, the message will go away 
       after a little while and the program will execute normally, but the 
       message will return when another infected .COM file is executed. 
 
       This virus does not appear to do any malicious damage. 
 
       Known Variant(s) of Japanese Christmas are: 
       Japanese-709: Received in October, 1992, Japanese-709 or 
              DAPDM-13 is a 709 byte variant of the Japanese Christmas 
              virus described above.  It infects one .COM file each time 
              an infected program is executed.  Infected programs will have 
              a file length increase of 709 bytes with the virus being 
              located at the end of the file.  The file's date and time 
              will not be altered.  Two text strings can be found within 
              the viral code in infected files: 
              "*.*" 
              "PATH=*.COM" 
              Origin:  Japan  October, 1992. 
       Japanese Christmas-B: Functionally similar to the original virus, 
              Japanese Christmas-B is a minor variant with some code 
              modifications. 
              Origin:  Japan  October, 1992. 
       Japanese Christmas-C: Functionally similar to the original virus, 
              Japanese Christmas-C is a minor variant with some code 
              modifications. 
              Origin:  Japan  October, 1992. 
       Japanese Christmas-D: Functionally similar to the original virus, 
              Japanese Christmas-D is a minor variant with some code 
              modifications. 
              Origin:  Japan  October, 1992. 
       Japanese Cookie: Received in April, 1992, this variant infects 
              one .COM program in the current directory whenever an 
              infected program is executed.  Infected programs will have 
              a file length increase of 653 bytes with the virus being 
              located at the end of the file.  The program's date and time 
              in the DOS disk directory listing will not have been 
              altered.  The only text string visible in the viral code 
              in infected programs is "*.com". 
              Origin:  Japan  April, 1992. 

Show viruses from discovered during that infect .

Main Page