Japanese Christmas Virus

Virus Name: Japanese Christmas Aliases: Christmas In Japan, Japan V Status: Rare Discovery: September, 1989 Symptoms: .COM file growth; message Origin: Japan Eff Length: 600 Bytes Type Code: PNCK - Parasitic Non-Resident .COM Infector Detection Method: ViruScan, AVTK, F-Prot, NAV, Sweep, IBMAV, NAVDX, VAlert, PCScan, ChAV, NShld, LProt, Sweep/N, Innoc, NProt, AVTK/N, NAV/N, IBMAV/N Removal Instructions: Delete infected files General Comments: The Japanese Christmas virus was first reported in Japan in September, 1989. It was later isolated in Japan in late September, 1990. As of October, 1990, it was reported to be widespread in Japan. This virus is a 600 byte non-resident generic infector of .COM files. It will infect COMMAND.COM. When a program infected with the Japanese Christmas virus is executed, the virus will infect zero to one other .COM file in the current directory. If a file is infected, it will increase in length by 600 bytes, with the virus being located at the end of the infected file. On December 25th, if an infected file is executed, the following message will be displayed in the center of the screen: "A merry christmas to you" The message will flash and will be underlined for approximately half the time it is displayed. If left alone, the message will go away after a little while and the program will execute normally, but the message will return when another infected .COM file is executed. This virus does not appear to do any malicious damage. Known Variant(s) of Japanese Christmas are: Japanese-709: Received in October, 1992, Japanese-709 or DAPDM-13 is a 709 byte variant of the Japanese Christmas virus described above. It infects one .COM file each time an infected program is executed. Infected programs will have a file length increase of 709 bytes with the virus being located at the end of the file. The file's date and time will not be altered. Two text strings can be found within the viral code in infected files: "*.*" "PATH=*.COM" Origin: Japan October, 1992. Japanese Christmas-B: Functionally similar to the original virus, Japanese Christmas-B is a minor variant with some code modifications. Origin: Japan October, 1992. Japanese Christmas-C: Functionally similar to the original virus, Japanese Christmas-C is a minor variant with some code modifications. Origin: Japan October, 1992. Japanese Christmas-D: Functionally similar to the original virus, Japanese Christmas-D is a minor variant with some code modifications. Origin: Japan October, 1992. Japanese Cookie: Received in April, 1992, this variant infects one .COM program in the current directory whenever an infected program is executed. Infected programs will have a file length increase of 653 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory listing will not have been altered. The only text string visible in the viral code in infected programs is "*.com". Origin: Japan April, 1992.