Virus Name: Holiday
V Status: Rare
Discovered: October, 1993
Symptoms: .COM & .EXE growth; system hangs;
Decrease in total system & available free memory
Eff Length: 2,900 - 2,916 Bytes
Type Code: PRhAK - Resident Parasitic .COM Infector
Detection Method: ViruScan, AVTK, F-Prot, IBMAV, Sweep, NAVDX,
NAV, VAlert, PCScan,
NShld, AVTK/N, NProt, Sweep/N, IBMAV/N, NAV/N, LProt
Removal Instructions: Delete infected files
The Holiday virus was submitted in October, 1993, and is from
Indonesia. Holiday is a memory resident infector of .COM and .EXE
programs, including COMMAND.COM.
When the first Holiday infected program is executed, this virus
will install itself memory resident at the top of system memory but
below the 640K DOS boundary, not moving interrupt 12's return. Total
system and available free memory, as indicated by the DOS CHKDSK
program, will have decreased by 2,912 bytes. Interrupt 21 will be
hooked by Holiday in memory.
Once the Holiday virus is memory resident, it will infect .COM and
.EXE programs when they are executed. Infected .COM programs
increase in size by 2,900 bytes while .EXE programs will have a file
length increase of 2,906 to 2,916 bytes. In both cases, the virus
will be located at the end of the file. The following text strings
are visible within the viral code in all Holiday infected programs:
"I'm very sorry, today is my holiday."
"So, I can't serve you, cause I want to play on your computers."
"DON'T TURN OFF YOUR COMPUTER UNTIL TOMORROW,"
"OR YOUR DATA WILL BE LOST!!!"
"I'll be back to serve you tomorrow."
"Thank You for playing, see you..."
"Please, hit ENTER!"
System hangs may occur when some infected programs are executed.