| Chr | |
|---|---|
| Type | File virus |
| Creator | |
| Date Discovered | 1993.03 |
| Place of Origin | |
| Source Language | |
| Platform | DOS |
| File Type(s) | .com, .exe |
| Infection Length | 869 or 1,348 bytes |
| Reported Costs | |
Chr is a virus sometimes referred to as Christmas, though its relation to the holiday is unknown.
Behavior
When Chr is executed, it becomes memory resident, installing itself just below the 640K DOS boundary, taking up 3,120 bytes. It infects .com and .exe files as they are executed. It appends 869 bytes to .com files and 1,348 to .exe files. If an infected file is executed when the virus is already in memory, it will display a hash symbol (#) in the next line on the command prompt. Chr will avoid infecting COMMAND.COM.
Name and Origin
The virus is sometimes called "Christmas", but most antivirus products refer to it as Chr, sometimes followed by the number 868 or 869 (there seems to be some confusion about that extra byte). Its association with the Christmas holiday is unknown, since all it displays is a # symbol and there are no text strings in the binary code indicating any. Its point of origin and isolation are unknown and it was first seen in March of 1993.
Sources
Patricia Hofman. VSUM Online, CHR-869 Virus.