Article View: comp.virus
Article #5012December 24th virus (PC)
From: Fridrik Skulason
Date: Thu, 28 Dec 1989 01:34
Date: Thu, 28 Dec 1989 01:34
22 lines
1234 bytes
1234 bytes
I just received a sample of the "December 24th" virus I reported on VALERT-L earlier today. As I suspected, the virus is just a new variant of the Icelandic virus, or rather a variant of Icelandic-2. The major changes I have seen are: The virus length is now 848-863 bytes If an infected program is run on December 24th, any attempt to run another program later that day will just produce the message "Gledileg Jol" (Icelandic for "Merry Christmas"). The creation date of infected files is not changed. A few NOP instructions have been added. Apart from this, the virus seems very similar to Icelandic-2. (Infects only EXE files, only 1 out of 10, bypasses INT 21 etc.) More details later, when I have had the time to disassemble the entire virus. - -frisk
Technical Details
Message-ID:
<0003.9001021329.AA00784@ge.sei.cmu.edu>Path:
arc1-ca.pugleaf.net!utzoo!utgpu!jarvis.csri.toronto.edu!mailrus!shadooby!samsung!brutus.cs.uiuc.edu!apple!rutgers!netnews.upenn.edu!vax1.cc.lehigh.edu!sei.cmu.edu!krvwShow Full Headers
Complete Article Headers
Path: arc1-ca.pugleaf.net!utzoo!utgpu!jarvis.csri.toronto.edu!mailrus!shadooby!samsung!brutus.cs.uiuc.edu!apple!rutgers!netnews.upenn.edu!vax1.cc.lehigh.edu!sei.cmu.edu!krvw From: frisk@rhi.hi.is (Fridrik Skulason) Newsgroups: comp.virus Subject: December 24th virus (PC) Message-ID: <0003.9001021329.AA00784@ge.sei.cmu.edu> Date: 28 Dec 89 01:34:33 GMT Sender: Virus Discussion List <VIRUS-L@IBM1.CC.Lehigh.EDU> Lines: 22 Approved: krvw@sei.cmu.edu