Virus.DOS.WeihNacht or WeihNacht is a virus that runs on MS-DOS.


WeihNacht is a benign memory resident parasitic virus. They hook onto INT 21h and write themselves to the end of .EXE files that are executed. It masquerades as PKUNZIP, one of the popular unzipping programs at the time, but doesn't actually unzip or manipulate files, instead pretending to unzip them without actually doing anything. The virus can't damage files in this way, nor can it alter them in any way possible.


On December 24 of any year, the virus plays the Christmas Carol Silent Night through the computer's speakers, and takes control away from the user. After the music finishes, the user regains control over the system. The virus then decrypts and displays the following message:

Ich hoffe, sie haben zu Weihnachten einen Virus-Scanner bekommen!

Which, when translated into English, means:

I hope they got a virus scanner for Christmas!

The virus' name, WeihNacht, comes from the German word for Christmas, referring both to its payload and the date on which its payload is deployed.

Afterwards, the virus returns control to the user.


This virus has 2 versions:

  • Virus.DOS.WeihNacht.1111
  • Virus.DOS.WeihNacht.1827



Securelist (Kaspersky Labs), Virus.DOS.WeihNacht.1111