%%File: VIRS0043.TXT
%%Name/Aliases: merryxmas, Merry Xmas
%%Platform: Macintosh
%%Type: Program., 
%%Disk Location: Hypercard stack.
%%Features: Direct acting.
%%Damage: No damage, only replicates., Can cause Hypercard to quit
%%Size: 0 to 1 file allocation block
%%See Also: 
%%Notes: Analysis of the Macintosh Merry Xmas virus  11/3/93
W. J. Orvis

Type: Program  virus in a Hypercard script
Infection: Infects all open, unlockable stacks by copying itself to the 
end of the stack script.
Damage: None intentional
Size: 0 to 1 allocation block since it adds to the end of the stack 
script, and the stack script is increased by an allocation block 
whenever the script extends passed the end of the current block.

Disinfection: Open hypercard, switch to the last card in the home stack 
and set it to scripting. Open the infected stack select Objects Stack 
Info and click Script. Find the virus at the end of the script and 
delete it. To make it so SAM won't detect it, type enough characters to 
overwrite the script, save it, then delete the typed characters and save 
it again. Check the stack script on your home stack to see if it was 
infected while you were disinfecting the infected stack.

When the virus is active, the disk is continually accessed by an 'on 
idle' procedure, even though it is not infecting the stack. If the stack 
is from Hypercard version 1, the virus can not infect it because it can 
not be unprotected. If the stack is converted to version 2, the virus 
can unprotect and infect it. 

SAM with the 4/27/93 virus definitions will see this virus. If the virus 
has simply been deleted, the virus key will still be in the stack beyond 
the EOF for the stack script causing SAM to detect the virus in a 
disinfected stack. The virus inserts itself by counting off a number of 
lines from the bottom of the stack, so adding lines to the virus will 
mess it up.