Type File virus
Date Discovered 1993.03
Place of Origin
Source Language
Platform DOS
File Type(s) .com, .exe
Infection Length 869 or 1,348 bytes
Reported Costs

Chr is a virus sometimes referred to as Christmas, though its relation to the holiday is unknown.


When Chr is executed, it becomes memory resident, installing itself just below the 640K DOS boundary, taking up 3,120 bytes. It infects .com and .exe files as they are executed. It appends 869 bytes to .com files and 1,348 to .exe files. If an infected file is executed when the virus is already in memory, it will display a hash symbol (#) in the next line on the command prompt. Chr will avoid infecting COMMAND.COM.

Name and Origin

The virus is sometimes called "Christmas", but most antivirus products refer to it as Chr, sometimes followed by the number 868 or 869 (there seems to be some confusion about that extra byte). Its association with the Christmas holiday is unknown, since all it displays is a # symbol and there are no text strings in the binary code indicating any. Its point of origin and isolation are unknown and it was first seen in March of 1993.


Patricia Hofman. VSUM Online, CHR-869 Virus.

Unless otherwise stated, the content of this page is licensed under Creative Commons Attribution-NonCommercial-ShareAlike 3.0 License