frisk@rhi.hi.is (Fridrik Skulason) (12/28/89)
I just received a sample of the "December 24th" virus I reported on VALERT-L earlier today. As I suspected, the virus is just a new variant of the Icelandic virus, or rather a variant of Icelandic-2. The major changes I have seen are: The virus length is now 848-863 bytes If an infected program is run on December 24th, any attempt to run another program later that day will just produce the message "Gledileg Jol" (Icelandic for "Merry Christmas"). The creation date of infected files is not changed. A few NOP instructions have been added. Apart from this, the virus seems very similar to Icelandic-2. (Infects only EXE files, only 1 out of 10, bypasses INT 21 etc.) More details later, when I have had the time to disassemble the entire virus. - -frisk