%%File: VIRS0232.TXT
%%Name/Aliases: Christmas, 1539, Father Christmas, Choinka, Tannenbaum, 
Christmas Tree, XA1, V1539
%%Platform: PC/MS-DOS
%%Type: Program., 
%%Disk Location: COM application., COMMAND.COM.
%%Features: Encrypted, Direct acting.
%%Damage: Interferes with a running application., Corrupts boot sector
%%Size: 1539
%%See Also: Vienna
%%Notes: The virus infects .COM files when an infected application is 
executed. When an infected program is run between December 24th and 31st 
(any year), the virus displays a full screen image of a christmas tree 
and German seasons greetings.  When an infected program is run on April 
1st (any year), it drops a code into the boot-  sectors of floppy A: and 
B: as well as into  the partition table of the hard disk. The old  
partition sectors are saved but most likely destroyed since running 
another infected  file will save the modified partition table  to the 
same location. On any boot attempt from an infected hard disk or floppy, 
the text "April April" will be displayed and the PC  will hang.  "April 
April" printed at boot time then the machine hangs.
A Christmas tree and German seasons greetings printed between 12/24 and 
12/31.   The virus contains the following German string:  "Und er lebt 
doch noch : Der Tannenbaum !",0Dh, 0Ah,00h, "Frohe Weihnachten 
...",0Dh,0Ah,07h,  00h (translated in English: "And he lives: the 
Christmas tree", "Happy Christmas")