Holiday Virus

 Virus Name:  Holiday 
 V Status:    Rare 
 Discovered:  October, 1993 
 Symptoms:    .COM & .EXE growth; system hangs; 
              Decrease in total system & available free memory 
 Origin:      Indonesia 
 Eff Length:  2,900 - 2,916 Bytes 
 Type Code:   PRhAK - Resident Parasitic .COM Infector 
 Detection Method:  ViruScan, AVTK, F-Prot, IBMAV, Sweep, NAVDX, 
                    NAV, VAlert, PCScan, 
                    NShld, AVTK/N, NProt, Sweep/N, IBMAV/N, NAV/N, LProt 
 Removal Instructions:  Delete infected files 
 General Comments: 
       The Holiday virus was submitted in October, 1993, and is from 
       Indonesia.  Holiday is a memory resident infector of .COM and .EXE 
       programs, including COMMAND.COM. 
       When the first Holiday infected program is executed, this virus 
       will install itself memory resident at the top of system memory but 
       below the 640K DOS boundary, not moving interrupt 12's return.  Total 
       system and available free memory, as indicated by the DOS CHKDSK 
       program, will have decreased by 2,912 bytes.  Interrupt 21 will be 
       hooked by Holiday in memory. 
       Once the Holiday virus is memory resident, it will infect .COM and 
       .EXE programs when they are executed.  Infected .COM programs 
       increase in size by 2,900 bytes while .EXE programs will have a file 
       length increase of 2,906 to 2,916 bytes.  In both cases, the virus 
       will be located at the end of the file.  The following text strings 
       are visible within the viral code in all Holiday infected programs: 
            "I'm very sorry, today is my holiday." 
            "So, I can't serve you, cause I want to play on your computers." 
            "OR YOUR DATA WILL BE LOST!!!" 
            "I'll be back to serve you tomorrow." 
            "Thank You," 
            "Thank You for playing, see you..." 
            "Please, hit ENTER!" 
       System hangs may occur when some infected programs are executed. 

Show viruses from discovered during that infect .

Main Page