Menu
Home
People
Places
Arts
History
Plants & Animals
Science
Life & Culture
Technology
Reference.org
Christmas Tree EXEC
open-in-new
<h2 id="operation">Operation</h2> <p>The program displays this message, and then forwards itself to <a href="/facts/Email_address/srdpG6am">mailbox addresses</a> contained in the user's <a href="/facts/Address_book/JdYNCHD7">address file</a>.<a class="footnote-ref" id="fnref:2" href="#fn:2"><sup>2</sup></a> </p> * * *** ***** ******* ********* ************* A ******* *********** VERY *************** ******************* HAPPY *********** *************** CHRISTMAS ******************* *********************** AND MY *************** ******************* BEST WISHES *********************** *************************** FOR THE NEXT ****** ****** YEAR ****** <h2 id="details">Details</h2> <p>The name was actually "CHRISTMA EXEC" because on IBM VM systems of the time, a file was identified by an eight character file name and an eight character file type. The customary file type for a REXX program is "EXEC" and command shells assume that file type by default. In text, the file name and file type were often written together as two words. The name of this worm is sometimes written as the more natural "CHRISTMAS EXEC" by mistake. </p><p>The worm would read the user's contact list (the CMS NAMES file), and transmit the worm to every address in it using the SENDFILE program (On these networks, one could send files per se, in addition to email; there was in fact no way to attach a file to an email). Users who received the program could see from the EXEC file type that it was an executable program, and with no history of malicious worms then existing, users would often receive the program and run it just out of curiosity. Some users would read the REXX code first and see comments at the top telling them it is a fun Christmas card for them to run. The text there went so far as to discourage the reader from trying to read the code, saying it would be more fun just to run it and see what it does. </p><p>Some versions of the worm had concealed code. The actual executable part of the worm was contained in several overly long lines (more than 80 characters) that were not visible unless the user scrolled the screen to the right. The IBM 3279 color terminal would display the Christmas tree with some blinking colored characters (asterisks) to represent tree lights. </p> <h2 id="see-also">See also</h2> <ul><li><a href="/facts/Trojan_horse_(computing)/FVqh3nDy">Trojan horse (computing)</a></li> <li><a href="/facts/Timeline_of_computer_viruses_and_worms/B18aAYVG">Timeline of computer viruses and worms</a></li> <li><a href="/facts/ASCII_art/TmgLtCg5">ASCII art</a></li></ul> <h2 id="further-reading">Further reading</h2> <ul><li>Burger, Ralf (1988). <a href="https://archive.org/details/computervirusesh0000burg/page/276"><i>Computer viruses – a high tech disease</i></a>. Abacus/Data Becker GmbH. p. <a href="https://archive.org/details/computervirusesh0000burg/page/276">276</a>. <a href="/facts/ISBN_(identifier)/15AdSPa9">ISBN</a> 1-55755-043-3.</li> <li>Capek, P.G.; Chess, D.M.; White, S.R.; Fedeli, A. (2003). "Merry Christma: An Early Network Worm". <i>IEEE Security & Privacy</i>. 1 (5): 26–34. <a href="/facts/Doi_(identifier)/muM9Etpq">doi</a>:<a href="https://doi.org/10.1109%2FMSECP.2003.1236232">10.1109/MSECP.2003.1236232</a>.</li> <li>Martin, Will (March 4, 1988). <a href="http://securitydigest.org/rutgers/mirror/pyrite.rutgers.edu/christmas.exec">"Re: BITNET Security"</a>. <i>Security Digest</i> (Mailing list). <a href="https://web.archive.org/web/20060925015504/http://securitydigest.org/rutgers/mirror/pyrite.rutgers.edu/christmas.exec">Archived</a> from the original on September 25, 2006. Retrieved October 30, 2008.</li> <li>Patterson, Ross (December 21, 1987). <a href="http://catless.ncl.ac.uk/Risks/5.80.html#subj1.1">"Re: IBM Christmas Virus"</a>. <i><a href="/facts/RISKS_Digest/dK68sfaI">RISKS Digest</a></i> (Mailing list). Retrieved October 30, 2008.</li> <li><a href="https://web.archive.org/web/20080917175424/http://vx.netlux.org/exotic.php">"Viruses for the "Exotic" Platforms"</a>. <i>VX Heaven</i>. c. 2004. Archived from <a href="http://vx.netlux.org/exotic.php">the original</a> on September 17, 2008.</li></ul> <h2 id="external-links">External links</h2> <ul><li><a href="https://archive.today/20130903155523/http://vxheaven.org/dl/exp/CHRISTMAS">Source code</a> (archived)</li></ul> <h2 id="references">References</h2> <ol> <li id="fn:1"><p>Tom Scott (2015-12-21). "A Christmas Computer Bug, and the Future of Files" (video). YouTube. Archived from the original on 2021-12-21. Retrieved 2017-11-05. <a href="/wiki/Tom_Scott_(entertainer)" target="_blank">/wiki/Tom_Scott_(entertainer)</a> <a href="#fnref:1" class="footnote-back-ref">↩</a></p></li> <li id="fn:2"><p>"Viruses for the 'Exotic' Platforms (VX heaven)". c. 2004. Archived from the original on 2013-08-06. <a href="https://web.archive.org/web/20130806063008/http://vxheaven.org/exotic.php" target="_blank">https://web.archive.org/web/20130806063008/http://vxheaven.org/exotic.php</a> <a href="#fnref:2" class="footnote-back-ref">↩</a></p></li> </ol>