Quite recently, people were talking of a "new type of virus" that spread via E-mail and had clearly hit the collective consciousness.

"Kindly check the attached love letter..."

Melissa wasn't much of a virus. But beg people to open a "love letter", they'll easily do that.

Many people complained how people could be so stupid and run the thing - because if they did, they sent the virus to people in their address book... Mail severs came crashing down, admins growled, and the (l)users stood there with blush as the admins told them "don't run executable attachments, fools".

Many friends of mine said they were sad that they did not get any copies of this virus (I didn't, either, but got later viruses - such as Hybris and Sircam - more than enough). They said they wanted to witness the born of another type of virus, and another nail in Microsoft's coffin.

This (or Melissa shortly before it), however, was not the first incident of its kind.

The first "half-a-worm-half-a-virus" thing of this kind was made a lot earlier.


And it wasn't a love letter, it was something more mundane but still pretty much warm and happy: A christmas card.

In Christmas 1987, someone in Germany side of EARN network made CHRISTMA EXEC - a Rexx script that runs on IBM mainframes with VM/CMS. The script was pretty simple: It displayed a simple christmas tree (drawn with *s) and greetings appropriate to the time of the festivities.

The top part of the script was somewhat unremarkable. It just had instructions like "Reading this file is not fun, run it instead!..."

Then came the juicy part: It took the user's NAMES file (that is, in modern terms, the user's E-mail address book) and sent a copy of the script to all addresses found in it, and then deleted itself.

The virus couldn't first spread because most sites with VM/CMS were not connected to BITNET. When it spread to IBM's network VNET, the whole network was down for two days.

The fight was also on. Mailboxes were purged by hand, but anti-viral tools appeared later on. People even developed a "countervirus" that followed the virus and deleted it where it was.


Juicy, isn't it? The "new" virus of our age is written in a simple scripting language, doesn't follow coding conventions (christma.exec had an uninformative comment, loveletter had sucky formatting), Use of address book, and even smartest of the users were at times tricked to execute it... There were differences though - the christmas card virus used file transfer system of the age, not the E-mail system.

If I ever find the source code for the worm, that might be excellent node material...


  • RISKS Digest Volume 6 issue 1