Merry Xmas Virus
Virus Name: Merry Xmas
V Status: Rare
Discovered: April, 1993
Symptoms: .EXE file growth; TSR; "Silent Night" played & message;
Eff Length: 1,694 - 1,708 Bytes
Type Code: PRsE - Parasitic Resident .EXE Infector
Detection Method: ViruScan, F-Prot, Sweep, NAV, IBMAV, AVTK,
NAVDX, VAlert, PCScan, ChAV,
LProt, NShld, LProt, Sweep/N, NAV/N, NProt,
AVTK/N, IBMAV/N, Innoc
Removal Instructions: Delete infected files
The Merry Xmas virus was submitted in April, 1993. Its origin or
point of isolation is unknown. Merry Xmas is a memory resident
infector of .EXE programs. It plays music during the Christmas
When the first Merry Xmas infected program is executed, the Merry
Xmas virus will install itself memory resident as a low system
memory TSR of 2,016 bytes. Interrupts 21 and 63 will be hooked by
the virus in memory.
Once the Merry Xmas virus is memory resident, it will infect .EXE
programs when they are executed. Infected programs will have a
file length increase of 1,694 to 1,708 bytes with the virus being
located at the end of the file. The program's date and time in the
DOS disk directory listing will not be altered. The following
text string can be found within the Merry Xmas viral code in all
"Merry Christmas and happy new year !
Written from Tamsui Oxford College."
During the Christmas season, the Merry Xmas virus' TSR will be
2,000 bytes in size, and hook interrupts 08, 21, and 63. It will
play "Silent Night" on the system speaker, and display the above
text string as a message, after the virus has been memory resident
for a few minutes. A system hang will then occur.