Merryxmas HyperCard Virus (31-July-1993)
Entry...............: Merryxmas Virus
Alias(es)...........: ---
Virus Strain........: ---                                          
Virus detected when.: October 1991           
              where.: Cornell University, USA
Classification......: Hypercard stacks infector
Length of Virus.....: 1384 Bytes (XCMD Resources)
--------------------- Preconditions -------------------------------------
Operating System(s).: MacOS proprietary and Hypercard            
Version/Release.....: All                     
Computer model(s)...: Apple Macintosh: all models with 128 KByte ROM
--------------------- Attributes ----------------------------------------
Easy Identification.: Stack contains resources "XCMD" ID 69 and ID 405
Resource pattern....: XCMD 69 "openbackground", XCMD 405 "viralcopy" 
Type of infection...: Virus infects hypercard stack scripts.
Infection trigger...: Virus will infect other stack scripts when an 
                         infected stack is opened. An uninfected Home 
                         stack will be infected first.
Applications affected: All Hypercard stacks.
Traps intercepted...: ---
Damage..............: Permanent/Transient damage: Virus contains an XCMD 
                         which will shutdown the System without saving 
                         open documents; therefore, new documents are
                         lost. But virus script does not contain any 
                         command to execute XCMD.
Damage Trigger......: The script contains no commands to execute the 
                         damage routine which is in XCMD id 69 (at least
                         in the version available for analysis). 
Peculiarities.......: Virus is written in Hypertalk.
Similarities........: ---
--------------------- Agents --------------------------------------------
Countermeasures/direct:1. Delete XCMD Resource pattern from Home stack 
                          and all other infected stacks with ResEdit.
                       2. Start HyperCard and search in stackscript for 
                          string "on openbackground --merryxmas" and 
                          delete the script until string "end getxmas".
                       3. Then quit HyperCard.
                       4. Writeprotect HyperCard Home stack and then
                          delete the script virus from the other infected
                          stacks following step 2.
Countermeasures/software: merryxmas vaccine
--------------------- Acknowledgement -----------------------------------
Location............: Virus Test Center, University Hamburg, Germany
Classification by...: Thomas Piehl, Ralf Stegen
Documentation by....: Ralf Stegen
Date................: 31-July-1993
Information Source..: --- 

.