Re: Batch JCL on Windows/.NET ???

[Bruce Orcutt]

If it's the one I'm thinking of, it did exist.  I remember seeing it in 1988? 
or was it 1989? on a VM/CMS system that was connected to BITNET.

It was a REXX that, when ran,  print out an text graphic to the users screen, 
while mailing itself to everyone in your namesfile.  



-Original Message-
From: IBM Mainframe Discussion List [mailto:[EMAIL PROTECTED]
Behalf Of Hal Merritt
Sent: Monday, May 01, 2006 2:58 AM
To: IBM-MAIN@BAMA.UA.EDU
Subject: Re: Batch JCL on Windows/.NET ???


I have been curious about this so called "Christmas Tree Virus" for many
years. I hear it mentioned, but have never been able to verify it as a
real event or urban legend. 

-Original Message-
From: IBM Mainframe Discussion List [mailto:[EMAIL PROTECTED] On
Behalf Of Tim Hare
Sent: Friday, April 28, 2006 10:40 AM
To: IBM-MAIN@BAMA.UA.EDU
Subject: Re: Batch JCL on Windows/.NET ???

"Now you can get JCL errors AND viruses right on the same machine."

You always could -  ex: the "Christmas Tree Virus" which was probably
more 
of a "worm" on VM/Profs  which I'm sure affected some machines with MVS 
guests (and it's old enough that it was called MVS then I believe, 
possibly MVS/XA or /ESA but still MVS).

It's just a lot harder to do, and a LOT  harder to infect the operating 
system itself. Applications, however, are probably easier.

Tim Hare
Senior Systems Programmer
Florida Department of Transportation
(850) 414-4209

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html

**
The information contained in this message, including attachments, may contain 
privileged or confidential information that is intended to be delivered only to 
the 
person identified above. If you are not the intended recipient, or the person 
responsible for delivering this message to the intended recipient, ALLTEL 
requests 
that you immediately notify the sender and asks that you do not read the 
message or its 
attachments, and that you delete them without copying or sending them to anyone 
else. 

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html

Re: Batch JCL on Windows/.NET ???

[Shmuel Metz (Seymour J.)]

In <[EMAIL PROTECTED]>, on
05/01/2006
   at 01:58 AM, Hal Merritt <[EMAIL PROTECTED]> said:

>I have been curious about this so called "Christmas Tree Virus" for
>many years. I hear it mentioned, but have never been able to verify
>it as a real event or urban legend.

It was a real event and it was not a virus. PROFS had executable
content in its e-mail.
 
-- 
 Shmuel (Seymour J.) Metz, SysProg and JOAT
 ISO position; see  
We don't care. We don't have to care, we're Congress.
(S877: The Shut up and Eat Your spam act of 2003)

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html

Re: Batch JCL on Windows/.NET ???

[Charles Mills]

You're right, of course. I had forgotten that part. PROFS notes had no
ability to execute anything. We've made so much "progress" now with HTML and
VBS e-mails that I had forgotten how primitive things were in the bad old
days. 

Charles

-Original Message-
From: IBM Mainframe Discussion List [mailto:[EMAIL PROTECTED] On Behalf
Of Tony Harminc
Sent: Monday, May 01, 2006 1:17 PM
To: IBM-MAIN@BAMA.UA.EDU
Subject: Re: Batch JCL on Windows/.NET ???


Charles Mills wrote:
[CHRISTMA EXEC]
> I remember it. It was a real event. I was working closely with IBM at 
> the time. I had a BP or similar IBM PROFS account.
> 
> It was a Christmas greeting in the PROFS system that when you opened 
> it, it executed a script that re-sent the greeting to everyone in your 
> PROFS address book. IBM had to take down PROFS for a day or two to get 
> things cleaned up.

It's important to remember that CHRISTMA EXEC was not self executing. It was
simply a little Rexx program that started with some comment lines to the
effect that reading this program was boring, but running it was more
interesting. It looked as though it was going to produce a picture of a
Christmas tree on the screen, but of course it also did the
address-book-and-send thing.

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html

Re: Batch JCL on Windows/.NET ???

[Tony Harminc]

Charles Mills wrote:
[CHRISTMA EXEC]
> I remember it. It was a real event. I was working closely with IBM at 
> the time. I had a BP or similar IBM PROFS account.
> 
> It was a Christmas greeting in the PROFS system that when you opened 
> it, it executed a script that re-sent the greeting to everyone in your 
> PROFS address book. IBM had to take down PROFS for a day or two to get 
> things cleaned up.

It's important to remember that CHRISTMA EXEC was not self executing. It was
simply a little Rexx program that started with some comment lines to the
effect that reading this program was boring, but running it was more
interesting. It looked as though it was going to produce a picture of a
Christmas tree on the screen, but of course it also did the
address-book-and-send thing.

So it relied on social engineering, much as many current malware email
attachments do. Around the same time there actually *was* a bug in the VM
RDRLIST program that would treat a # character in a filename as a
terminator, and then execute the rest of the name, but I don't believe this
was ever exploited in the wild.
 
The whole story of CHRISTMA EXEC is at
http://vm.marist.edu/~vmshare/browse?fn=CHRISTMA&ft=PROB
With 2020 hindsight, it's amusing to see the early attempts at things we
take for granted now, such as quarantining suspicious attachments, and
training users not to open just any old file they receive.

Tony H.

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html

Re: Batch JCL on Windows/.NET ???

[John Eells]

Hal Merritt wrote:


I have been curious about this so called "Christmas Tree Virus" for many
years. I hear it mentioned, but have never been able to verify it as a
real event or urban legend. 




CHRISTMA EXEC was real.  IIRC (perhaps not, it's been a Long 
Time), it read your NAMES file and sent an e-mail to everyone in 
it, if you ran it.  The internal network in the Mid-Hudson Valley 
was shut down for a couple of hours while the VM teams cleaned 
things up.  (We were warned about it before I opened my mail that 
day.  I read it out of curiousity at the time, but did not save a 
copy.)


--
John Eells
z/OS Technical Marketing
IBM Poughkeepsie
[EMAIL PROTECTED]

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html

Re: Batch JCL on Windows/.NET ???

[Knutson, Sam]

Yes it was real.  See page 43 of Melinda Varian's paper.

http://www.princeton.edu/~melinda/25paper.pdf

Best Regards, 

Sam Knutson, GEICO 
Performance and Availability Management 
mailto:[EMAIL PROTECTED] 
(office)  301.986.3574 

"Think big, act bold, start simple, grow fast..." 

-Original Message-
From: IBM Mainframe Discussion List [mailto:[EMAIL PROTECTED] On
Behalf Of Hal Merritt
Sent: Monday, May 01, 2006 2:58 AM
To: IBM-MAIN@BAMA.UA.EDU
Subject: Re: Batch JCL on Windows/.NET ???

I have been curious about this so called "Christmas Tree Virus" for many
years. I hear it mentioned, but have never been able to verify it as a
real event or urban legend. 

This email/fax message is for the sole use of the intended
recipient(s) and may contain confidential and privileged information.
Any unauthorized review, use, disclosure or distribution of this
email/fax is prohibited. If you are not the intended recipient, please
destroy all paper and electronic copies of the original message.

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html

Re: Batch JCL on Windows/.NET ???

[Charles Mills]

I remember it. It was a real event. I was working closely with IBM at the
time. I had a BP or similar IBM PROFS account.

It was a Christmas greeting in the PROFS system that when you opened it, it
executed a script that re-sent the greeting to everyone in your PROFS
address book. IBM had to take down PROFS for a day or two to get things
cleaned up.

Charles



-Original Message-
From: IBM Mainframe Discussion List [mailto:[EMAIL PROTECTED] On Behalf
Of Hal Merritt
Sent: Sunday, April 30, 2006 11:58 PM
To: IBM-MAIN@BAMA.UA.EDU
Subject: Re: Batch JCL on Windows/.NET ???


I have been curious about this so called "Christmas Tree Virus" for many
years. I hear it mentioned, but have never been able to verify it as a
real event or urban legend. 

-Original Message-
From: IBM Mainframe Discussion List [mailto:[EMAIL PROTECTED] On
Behalf Of Tim Hare
Sent: Friday, April 28, 2006 10:40 AM
To: IBM-MAIN@BAMA.UA.EDU
Subject: Re: Batch JCL on Windows/.NET ???

"Now you can get JCL errors AND viruses right on the same machine."

You always could -  ex: the "Christmas Tree Virus" which was probably
more 
of a "worm" on VM/Profs  which I'm sure affected some machines with MVS 
guests (and it's old enough that it was called MVS then I believe, 
possibly MVS/XA or /ESA but still MVS).

It's just a lot harder to do, and a LOT  harder to infect the operating 
system itself. Applications, however, are probably easier.

Tim Hare
Senior Systems Programmer
Florida Department of Transportation
(850) 414-4209

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html

Re: Batch JCL on Windows/.NET ???

[Hal Merritt]

I have been curious about this so called "Christmas Tree Virus" for many
years. I hear it mentioned, but have never been able to verify it as a
real event or urban legend. 

-Original Message-
From: IBM Mainframe Discussion List [mailto:[EMAIL PROTECTED] On
Behalf Of Tim Hare
Sent: Friday, April 28, 2006 10:40 AM
To: IBM-MAIN@BAMA.UA.EDU
Subject: Re: Batch JCL on Windows/.NET ???

"Now you can get JCL errors AND viruses right on the same machine."

You always could -  ex: the "Christmas Tree Virus" which was probably
more 
of a "worm" on VM/Profs  which I'm sure affected some machines with MVS 
guests (and it's old enough that it was called MVS then I believe, 
possibly MVS/XA or /ESA but still MVS).

It's just a lot harder to do, and a LOT  harder to infect the operating 
system itself. Applications, however, are probably easier.

Tim Hare
Senior Systems Programmer
Florida Department of Transportation
(850) 414-4209

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html

Re: Batch JCL on Windows/.NET ???

[Tim Hare]

"Now you can get JCL errors AND viruses right on the same machine."

You always could -  ex: the "Christmas Tree Virus" which was probably more 
of a "worm" on VM/Profs  which I'm sure affected some machines with MVS 
guests (and it's old enough that it was called MVS then I believe, 
possibly MVS/XA or /ESA but still MVS).

It's just a lot harder to do, and a LOT  harder to infect the operating 
system itself. Applications, however, are probably easier.

Tim Hare
Senior Systems Programmer
Florida Department of Transportation
(850) 414-4209

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html

Re: Batch JCL on Windows/.NET ???

[Charles Mills]

Now you can get JCL errors AND viruses right on the same machine.

Charles

-Original Message-
From: IBM Mainframe Discussion List [mailto:[EMAIL PROTECTED] On Behalf
Of Robert Justice
Sent: Friday, April 28, 2006 6:37 AM
To: IBM-MAIN@BAMA.UA.EDU
Subject: Re: Batch JCL on Windows/.NET ???


Now you can get your windows viruses in batch mode. 

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html

Re: Batch JCL on Windows/.NET ???

[Robert Justice]

Now you can get your windows viruses in batch mode. 

--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html

Batch JCL on Windows/.NET ???

[Porowski, Ken]

What is this world coming to ...

http://www.netcobol.com/products/windows/neobatch.htm

Ken Porowski
AVP Systems Software
CIT Group
E: [EMAIL PROTECTED]



--
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to [EMAIL PROTECTED] with the message: GET IBM-MAIN INFO
Search the archives at http://bama.ua.edu/archives/ibm-main.html