1. /
  2. Security Response/
  3. CODE 252

CODE 252

Risk Level 1: Very Low

February 13, 2007 11:34:18 AM

CODE 252 is a virus discovered in California in April 1992. CODE 252 is designed to trigger any time an infected application is run between June 6 and December 31.

When the viral code is executed, CODE 252 displays the following message on the screen:
    You have a virus. Ha Ha Ha Ha Ha Ha Ha Now erasing all disks... Ha Ha Ha Ha Ha Ha Ha P.S. Have a nice day Ha Ha Ha Ha Ha Ha Ha (Click to continue...)

CODE 252 then deletes the viral code from the System file and the current application.

No files or directories are deleted, but a concerned user might turn off or restart the infected Macintosh after seeing the message. Doing this can cause disk corruption or other damage.

Between January 1st and June 5th of any year after 1991, CODE 252 spreads from applications to System files, and then from the infected System file to other applications.

Antivirus Protection Dates

  • Initial Rapid Release version December 20, 2000
  • Latest Rapid Release version August 20, 2008 revision 017
  • Initial Daily Certified version December 20, 2000
  • Latest Daily Certified version August 20, 2008 revision 016
  • Initial Weekly Certified release date pending
Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.

Threat Assessment


  • Wild Level: Low
  • Number of Infections: 0 - 49
  • Number of Sites: 0 - 2
  • Geographical Distribution: Low
  • Threat Containment: Easy
  • Removal: Easy


  • Damage Level: Low


  • Distribution Level: Low
Note: On May 14, 2015, modifications will be made to the threat write-ups to streamline the content. The Threat Assessment section will no longer be published as this section is no longer relevant to today's threat landscape. The Risk Level will continue to be the main threat risk assessment indicator.

Search Threats

Search by name
Example: W32.Beagle.AG@mm
STAR Antimalware Protection Technologies
Internet Security Threat Report