The solution was to create another, nonreplicating worm, called the Reaper, which would crawl through the system behind the Creeper and kill off the proliferating clones after they had performed their tasks. The experiment was abandoned when it became apparent that the Reaper would never be able to keep up with the proliferating number of Creepers.
There are other sorts of malicious programs, including what are known as trojans--after the Greek wooden horse. The first trojan incident was reported in Germany in 1987. On the afternoon of December 9th, several students at the University of Clausthal-Zellerfeld, just south of Hannover, logged in to their computers and found that they had received electronic mail in the form of a file called Christmas. On reading the file, they saw the message LET THIS EXEC RUN AND ENJOY YOURSELF! followed by a small drawing of a Christmas tree, crudely represented by asterisks. An "exec" is an executable file, or program, and the suggestion was that if they ran the program, a large Christmas tree would appear on their computer screens. By the side of the small drawing was the greeting: A VERY MERRY CHRISTMAS AND BEST WISHES FOR THE NEXT YEAR.
Underneath the drawing was a further message, in broken
English: BROWSING THIS FILE IS NO FUN AT ALL JUST TYPE "CHRISTMAS," followed by some seventy lines of computer instructions. The students could recognize that these instructions were written in an easy-to-use programming language that was available on their IBM mainframe, but few could comprehend what the program was designed to do. Most of the students decided to give the program a try, typed in "Christmas," and were duly rewarded with a large drawing of a Christmas tree. Typically, they then deleted the file. However the next time they logged in to their computers, they found that they had received more copies of the Christmas file, as had many other computer users at the university. What no one had realized was that as well as drawing a Christmas tree, the program had been reading the files containing the students' electronic address books with the details of their other regular contacts on the IBM mainframe computer. The program then sent a copy of itself to all the other names that it could find. It was an electronic chain letter: each time the program was run, it could trigger fifty, or a hundred, or even more copies of itself, depending on the size of each user's electronic address book.
The unidentified student who playfully introduced the Christmas file into the electronic mail system had probably visualized a little local fun. He hadn't realized that some of the university's computer users had electronic addresses outside Clausthal-Zellerfeld linked by EARNet, the European Academic Research Network. Or that when copies of the file started whizzing around EARNet, they would then find their way onto BitNet, an academic computer network linking 1,300 sites in the United States, and from there onto VNet, IBM's private worldwide electronic mail network, which links about four thousand mainframe computers and many more smaller computers and workstations. The electronic chain letter reached VNet on December 15th, just six days after it was launched.
IBM's corporate users typically carry more names and addresses in their files than university users. Soon thousands of copies of the file were circulating around the world; it quickly reached Japan, which, like all the addresses, was only seconds away by electronic mail. Within two days the rampaging programs brought IBM's entire network to a standstill, simply by sending Christmas greetings throughout the network. The company spent an unfestive Christmas season killing all copies of the file.
The program was later dubbed the IBM Christmas Tree Virus, but because it needed some user interaction--in this case, typing in the word Christmas--it isn't considered a true virus. User interaction implies inviting the intruder in behind your defenses, as the Trojans did with the Greek horse. But virus researchers have created a subcategory for trojans that replicate--as the IBM Christmas Tree did called, naturally enough, replicating trojans.
The pervasive media coverage of the Internet Worm was probably one reason for the next major computer incident that year. On December 23, 1988, just six weeks after Morris's Internet Worm hit the front pages, a very different worm hit the NASA Space Physics Astronomy Network (SPAN) and the Department of Energy computer networks.
