Merry Xmas Virus

Virus Name: Merry Xmas Aliases: V Status: Rare Discovered: April, 1993 Symptoms: .EXE file growth; TSR; "Silent Night" played & message; system hang Origin: Unknown Eff Length: 1,694 - 1,708 Bytes Type Code: PRsE - Parasitic Resident .EXE Infector Detection Method: ViruScan, F-Prot, Sweep, NAV, IBMAV, AVTK, NAVDX, VAlert, PCScan, ChAV, LProt, NShld, LProt, Sweep/N, NAV/N, NProt, AVTK/N, IBMAV/N, Innoc Removal Instructions: Delete infected files General Comments: The Merry Xmas virus was submitted in April, 1993. Its origin or point of isolation is unknown. Merry Xmas is a memory resident infector of .EXE programs. It plays music during the Christmas season. When the first Merry Xmas infected program is executed, the Merry Xmas virus will install itself memory resident as a low system memory TSR of 2,016 bytes. Interrupts 21 and 63 will be hooked by the virus in memory. Once the Merry Xmas virus is memory resident, it will infect .EXE programs when they are executed. Infected programs will have a file length increase of 1,694 to 1,708 bytes with the virus being located at the end of the file. The program's date and time in the DOS disk directory listing will not be altered. The following text string can be found within the Merry Xmas viral code in all infected programs: "Merry Christmas and happy new year ! Written from Tamsui Oxford College." During the Christmas season, the Merry Xmas virus' TSR will be 2,000 bytes in size, and hook interrupts 08, 21, and 63. It will play "Silent Night" on the system speaker, and display the above text string as a message, after the virus has been memory resident for a few minutes. A system hang will then occur.