I was working at IBM at the time on a VM system. This CHRISTMA EXEC showed up in my reader. I used PEEK in RDRLIST to start reading it.
One of the first things I noticed was comments at the top that suggested something to the effect of don't spoil the surprise by reading it, just run it. That seemed suspicious to me so then I was reading the whole thing. What it would do is put a Christmas scene on your 3270 terminal of like snowflakes falling, but meanwhile it would be reading your names file and sending a copy of itself to all of your contacts. Then suddenly it just disappeared while I was reading it. That kind of scared me for a minute. I was afraid that somehow I had triggered it without trying to by reading it. But it was okay. The systems people had had figured this thing out really quickly and somehow wiped out every copy on the system while I was reading it. I heard that someone named Christman had the userid CHRISTMA. The fix to block anything with the name CHRISTMA from the system caused him problems. I think he had to change his userid because the filter remained in place for a long time. On Tue, Sep 16, 2025, 11:34 AM Bill Bellach < [email protected]> wrote: > So that is the real question, I have come across English only copies from > 1988. Some old logs show that it did not really come from Germany but might > have come through the CUNY which was a BITNET HUB. Even in the book > Computer viruses : a high-tech disease by Burger, Ralf (1988) It had all > English, and why did only some of it have German while 99% was english. I > was a student at CUNY (College of Staten Island) in 1987 and only really > learned about this antique virus a few days ago. > > I'm trying to find out as much information as possible, problem is that it > was 38 years ago... > > On Tue, Sep 16, 2025 at 12:32 PM Jousma, David < > [email protected]> wrote: > > > Dutch. > > > > > > > > > > _______________________________ > > > > Dave Jousma > > > > Vice President | Director, Technology Engineering > > > > Fifth Third Bank | 1830 East Paris Ave, SE | Grand Rapids > <https://www.google.com/maps/search/rd+Bank+%7C+1830+East+Paris+Ave,+SE+%7C+Grand+Rapids?entry=gmail&source=g>, > MI 49546 > > > > > > > > > > > > > > From: IBM Mainframe Discussion List <[email protected]> on behalf > > of René Jansen <[email protected]> > > Date: Tuesday, September 16, 2025 at 12:19 PM > > To: [email protected] <[email protected]> > > Subject: Re: Looking for CHRISTMA EXEC > > > > CAUTION EXTERNAL EMAIL > > This message came from outside your organization. > > DO NOT open attachments or click on links from unknown senders or > > unexpected emails. > > Report Suspicious< > > > https://us-phishalarm-ewt.proofpoint.com/EWT/v1/MwwqYLOC6b6whF7V!rdOKGbGn7mFB0WfYrJjONHzdONpaCKC__zLHuA7Puz_Im-HW1QLpeCr-F9ZDtIYoln93CCV8bvISf5MVUmmOui8x3GaVD7Voumc$ > > > > > > > > > Hi Mike, > > > > So the author was German-speaking? > > > > Best regards, > > > > René. > > > > > On 16 Sep 2025, at 17:43, Mike Beer <[email protected]> wrote: > > > > > > You can find the source code here: > > > https://urldefense.com/v3/__https://archive.ph/20130903155523/http:/*vxheaven.org/dl/exp/CHRISTMAS__;Lw!!MwwqYLOC6b6whF7V!moeADN7ewHWSTPGk4-6jK_HjSXxHks6uXoaQHVpCgDz9YLOMsdvBMFS-cRR6LvjMYUY3tvJFjGqlzXx_18FBOoUETCjt3QVQ-EM$ > > > > > > > > > -----Ursprüngliche Nachricht----- > > > Von: IBM Mainframe Discussion List <[email protected]> Im > > Auftrag von Bill Bellach > > > Gesendet: Dienstag, 16. September 2025 17:27 > > > An: [email protected] > > > Betreff: Looking for CHRISTMA EXEC > > > > > > All, > > > > > > I am looking for anyone from 1987 that may have had information > > regarding the CHRISTMA EXEC virus. In particular I am looking for anyone > > who knows/knew Jerry Hoekstra, at that time I believe he was with Calvin > > University. > > > > > > > > > Thanks > > > Bill > > > > > > ---------------------------------------------------------------------- > > > For IBM-MAIN subscribe / signoff / archive access instructions, send > > email to [email protected] with the message: INFO IBM-MAIN > > > > > > ---------------------------------------------------------------------- > > > For IBM-MAIN subscribe / signoff / archive access instructions, > > > send email to [email protected] with the message: INFO IBM-MAIN > > > > ---------------------------------------------------------------------- > > For IBM-MAIN subscribe / signoff / archive access instructions, > > send email to [email protected] with the message: INFO IBM-MAIN > > > > > > > > This e-mail transmission contains information that is confidential and > may > > be privileged. It is intended only for the addressee(s) named above. If > > you receive this e-mail in error, please do not read, copy or disseminate > > it in any manner. If you are not the intended recipient, any disclosure, > > copying, distribution or use of the contents of this information is > > prohibited. Please reply to the message immediately by informing the > sender > > that the message was misdirected. After replying, please erase it from > your > > computer system. Your assistance in correcting this error is appreciated. > > > > > > ---------------------------------------------------------------------- > > For IBM-MAIN subscribe / signoff / archive access instructions, > > send email to [email protected] with the message: INFO IBM-MAIN > > > > ---------------------------------------------------------------------- > For IBM-MAIN subscribe / signoff / archive access instructions, > send email to [email protected] with the message: INFO IBM-MAIN > ---------------------------------------------------------------------- For IBM-MAIN subscribe / signoff / archive access instructions, send email to [email protected] with the message: INFO IBM-MAIN
