Fandom

Malware Wiki

WeihNacht

1,345pages on
this wiki
Add New Page
Comments0 Share

Virus.DOS.WeihNacht or WeihNacht is a virus that runs on MS-DOS.

Details

WeihNacht is a benign memory resident parasitic virus. They hook onto INT 21h and write themselves to the end of .EXE files that are executed. It masquerades as PKUNZIP, one of the popular unzipping programs at the time, but doesn't actually unzip or manipulate files, instead pretending to unzip them without actually doing anything. The virus can't damage files in this way, nor can it alter them in any way possible.

Payload

On December 24 of any year, the virus plays the Christmas Carol Silent Night through the computer's speakers, and takes control away from the user. After the music finishes, the user regains control over the system. The virus then decrypts and displays the following message:

Ich hoffe, sie haben zu Weihnachten einen Virus-Scanner bekommen!

Which, when translated into English, means:

I hope they got a virus scanner for Christmas!

The virus' name, WeihNacht, comes from the German word for Christmas, referring both to its payload and the date on which its payload is deployed.

Afterwards, the virus returns control to the user.

Variants

This virus has 2 versions:

  • Virus.DOS.WeihNacht.1111
  • Virus.DOS.WeihNacht.1827

Videos

References

Securelist (Kaspersky Labs), Virus.DOS.WeihNacht.1111

Ad blocker interference detected!


Wikia is a free-to-use site that makes money from advertising. We have a modified experience for viewers using ad blockers

Wikia is not accessible if you’ve made further modifications. Remove the custom ad blocker rule(s) and the page will load as expected.