Merry Xmas Virus

 Virus Name:  Merry Xmas 
 V Status:    Rare 
 Discovered:  April, 1993 
 Symptoms:    .EXE file growth; TSR; "Silent Night" played & message; 
              system hang 
 Origin:      Unknown 
 Eff Length:  1,694 - 1,708 Bytes 
 Type Code:   PRsE - Parasitic Resident .EXE Infector 
 Detection Method:  ViruScan, F-Prot, Sweep, NAV, IBMAV, AVTK, 
                    NAVDX, VAlert, PCScan, ChAV, 
                    LProt, NShld, LProt, Sweep/N, NAV/N, NProt, 
                    AVTK/N, IBMAV/N, Innoc 
 Removal Instructions:  Delete infected files 
 General Comments: 
       The Merry Xmas virus was submitted in April, 1993.  Its origin or 
       point of isolation is unknown.  Merry Xmas is a memory resident 
       infector of .EXE programs.  It plays music during the Christmas 
       When the first Merry Xmas infected program is executed, the Merry 
       Xmas virus will install itself memory resident as a low system 
       memory TSR of 2,016 bytes.  Interrupts 21 and 63 will be hooked by 
       the virus in memory. 
       Once the Merry Xmas virus is memory resident, it will infect .EXE 
       programs when they are executed.  Infected programs will have a 
       file length increase of 1,694 to 1,708 bytes with the virus being 
       located at the end of the file.  The program's date and time in the 
       DOS disk directory listing will not be altered.  The following 
       text string can be found within the Merry Xmas viral code in all 
       infected programs: 
               "Merry Christmas and happy new year ! 
                Written from Tamsui Oxford College." 
       During the Christmas season, the Merry Xmas virus' TSR will be 
       2,000 bytes in size, and hook interrupts 08, 21, and 63.  It will 
       play "Silent Night" on the system speaker, and display the above 
       text string as a message, after the virus has been memory resident 
       for a few minutes.  A system hang will then occur. 

Show viruses from discovered during that infect .

Main Page