| Tamsui | |
|---|---|
| Type | File virus |
| Creator | |
| Date Discovered | 1993.04 |
| Place of Origin | Tamsui, Taiwan |
| Source Language | |
| Platform | DOS |
| File Type(s) | |
| Infection Length | 1,649 bytes |
| Reported Costs | |
Tamsui, also known as Merry Xmas, or Christmas, is a memory resident virus from Taiwan. It plays a Christmas tune and displays a Christmas/New Year message on certain days.
Behavior
Then a file infected with Tamsui is executed, it will become memory resident. Files with .exe extensions are infected when they are executed. The virus appends its 1,649 bytes to the files. When executed on a day from December 23 to 27 (other reports say it activates between similar days in November, but that does not make sense if the message is Christmas-related, however "off-by-one" errors of various types are common programming mistakes), the virus will play the tune "Silent Night". It also displays the message: "Merry Christmas and happy new year ! Written from Tamsui Oxford college."
Variants
Tamsui is not known to be a variant of any virus nor does it seem to have any variants that one can clearly say are descended from the virus. However, Madsatan is considered similar to Tamsui and is sometimes considered a variant. Since the virus appears to be an isolate and was unremarkable except for its payload, antivirus products simply group it in with other viruses with a Christmas message (even Japanese Christmas).
Name and Origin
The virus was coded in Taiwan, probably by a student of Tamsui Oxford College, now known as Aletheia University. A researcher based in Taiwan says it is known there as the Merry Xmas virus.
Sources
Patricia Hofman. VSUM, Merry Xmas Virus.
Chung Yuan-Kai. Virus-L, VIRUS-L Digest Tuesday, 16 Aug 1994 Volume 7 : Issue 67. 1994.08.10
ProsSecure Threat Monitor, Virus.DOS.Christmas.1694.
Vesselin Bontchev. Virus-L, VIRUS-L Digest, Volume 7 : Issue 69.