Christmas tree virus: what it is and how to remove it
Christmas tree virus is a mass-mailer worm that can cause paralyze on the whole system. This malware is known since 1987, but it is still luring to affect users devices during the busiest time of the year.
Facts checked October 6, 2026. Removal steps tested on Windows 11 (26H2) and checked against Microsoft's and the browser makers' current documentation. Sections marked as our earlier report are the original text: they describe the threat as it was then and have not been reviewed since. The 2026 status, the removal steps and the questions are current.
Automatic
Get a free scan and check if your PC is infected.
Fortect finds malware, unwanted programs and the Windows damage they leave behind, and repairs it in one pass.
If Christmas tree virus keeps coming back after uninstalling, a scan can find what reinstalls it.
Do it yourself · free Remove Christmas tree virus yourself 4 steps, about 12 minutes, no software needed.
Start the steps
Christmas tree virus: summary
| Distribution | Infected email attachments |
|---|---|
| Name | Christmas tree virus |
| Type | Trojan/worm[2] |
| Category | Malware |
| Related | Christmas virus |
| Also known | Christmas tree exec |
| Removal | Scan the PC with security software to find and remove the malware and anything installed with it. Fortect scans Windows for malware and repairs the system files and settings it damaged. Remove it nowTo use the full-featured product, you have to purchase a license for Fortect. The scan is free. |
Show 8 more facts
| Known since | 1987 |
|---|---|
| Tactics | Once the targeted system gets infiltrated malware send the copy of itself to everyone on the email contact list |
| Detection names | No Microsoft detection name is known |
| Damage | Not recorded in the old report |
| Symptoms | An unknown program in Installed apps |
| Evidence | 5 write-ups by security sites; details still limited |
| First seen | 18 December 2018 |
| Facts checked | 6 October 2026 |
What Christmas tree virus does
From our report of Dec 2018 · not reviewed since
Christmas tree virus is a strain of Christmas virus that grows from a system flaw to a malware weapon
Christmas tree virus is a mass-mailer worm that can cause paralyze on the whole system.
This malware is known since 1987, but it is still luring to affect users devices during the busiest time of the year. When Christmas time rolls around, malicious actors take advantage of the holiday and spread their products. Christmas virus category has a lot of different threats used during the Holidays and Christmas tree exec is one of the more known.
This malware arrives in an email with the subject line "Let this exec run and enjoy yourself!" and later on spreads the script on a whole network and causes havoc. The user must execute the malicious code by typing christma or christmas, and the text message gets displayed on the screen with a Christmas tree.
Christmas tree virus is called one of the first computer malware products that changed the history if the cybersecurity. Rexx language is used for this malware code to launch the malicious script and drew the Christmas tree on the screen and display the text. When this is done malware targets email contacts of the victim and sends the copy of this malicious virus to every one of them.
This malware dubbed Christmas tree virus is the first mass-mailing worm and one of the most prominent cyber threats that can paralyze a system and affect the device from one insecure email notification. The user needs to execute the malicious code by manually entering christma or christmas, and the ASCII Christmas tree gets displayed on the screen.
Also, Christmas tree exec developers hide the message in the virus source code: browsing this file is no fun at all just type CHRISTMAS from cms. The man message delivered to the victims' computer alongside the Christmas tree reads the following:
Christmas tree virus is a worm that runs on various systems except for VM/CMS. Names and Netlog information are unique on these systems, so this malware cannot collect the contact information necessary for the replication and REXX language interpretation.
People tend to overlook many things online while shopping for Christmas gifts or browsing on the busy Holiday schedule, so malicious actors release their malware and other programs during this time. No exception is the Christmas tree virus because the first version was launched on December 9th. Even though, the initial attack was in 1987 this holiday malware category is affecting users all over the world in 2018 too.
You need to remove the Christmas tree virus from the system using a reputable anti-malware program like . This type of cyber threats requires a full system scan during malware removal. Especially, when dealing with trojans and worms because experts note about the background processes and additional system changes these programs can make on the device.
Make sure to perform a Christmas tree virus removal using a trustworthy tool because of risk getting cyber infections during insecure installations. You may also need to enter the Safe Mode before running the anti-malware program so your program can run smoothly as it supposed to.
From our report of Dec 2018 · not reviewed since
More from our earlier report on Christmas tree virus
- Use anti-malware like and clean the system further while performing Christmas tree virus removal
- A VERY HAPPY CHRISTMAS AND MY BEST WISHES FOR THE NEXT YEAR
How Christmas tree virus spreads and got on your PC
From our report of Dec 2018 · not reviewed since
Worms, malware, and trojans can gain access to the system of your computer using various techniques.
These methods include fake updates or installs, hyperlinks, and fake tools. However, the most common technique is spam emails with attached files that contain malicious script and payload droppers.
Infected documents may look safe and legitimate because of the common format or file name, but the message on the email itself is neither valuable or legitimate. Malicious executables distribute trojans, worms or other malware and launch the process on the system automatically.
Unfortunately, these files can be set to launch further malware distribution and infect the device with more severe infections like ransomware or cryptojacking malware. Be aware that you can scan the file before opening it on the device and delete suspicious emails without even opening them.
How to remove Christmas tree virus
Clean the USB drives as well as the PC, or the worm comes back the next time a stick is plugged in.
Step 1: Clean the USB drives
USB worms hide your folders and put shortcuts with the same names in their place. Do not open any of those shortcuts; delete every
.lnkfile in the root of the drive.Open Command Prompt, type the drive letter (for example
E:), press Enter and runattrib -h -r -s /s /d *.*to make the hidden folders visible again.Scan each drive with Microsoft Defender before you use it on another PC, which works the same in Windows 11 and Windows 10.
Full procedure with screenshots: Run a Microsoft Defender Offline scan
Step 2: Remove it from startup
Press Ctrl + Shift + Esc to open Task Manager and select Startup apps (Windows 11) or the Startup tab (Windows 10). Disable entries you do not recognise, especially ones with no publisher or with a name that copies a Windows component.
Right-click an entry and choose Open file location to see where it runs from: programs in
%AppData%or%Temp%deserve a closer look. Some entries are not listed there but in the registry Run keys, which the procedure below shows how to check.Full procedure with screenshots: Stop apps from opening at startup On uGetFix
Step 3: Delete scheduled tasks that bring it back
Programs like Christmas tree virus add a scheduled task so they return after an uninstall or reopen a page at every sign-in. Start Task Scheduler, open Task Scheduler Library and sort by Last Run Time to see what ran recently.
On the Actions tab, a program in a user folder, a script or a web address is a warning sign; right-click such a task and choose Delete.
Tasks with names copying Google, Edge or Windows updaters but pointing to an odd folder are typical. The tool looks the same in Windows 11 and Windows 10.
Windows 11: Task Scheduler Library, the task selected, the Actions tab shows the file it runs. Full procedure with screenshots: Remove what malware leaves behind in Windows
Step 4: Scan the PC, then run the offline scan
A scan finds the parts of Christmas tree virus that the manual steps cannot see. In Windows Security > Virus & threat protection > Scan options, start a Full scan and quarantine what it reports.
Follow it with Microsoft Defender Antivirus (offline scan) > Scan now, which restarts the PC and checks the disk while Windows and the malware are not running.
It takes about 15 minutes and works the same in Windows 11 and Windows 10. If either scan finds something, run the full scan again after removal until it comes back clean.
Windows 11: Windows Security > Virus & threat protection > Scan options. Full procedure with screenshots: Run a Microsoft Defender Offline scan
Instructions for each browser and system
The detailed steps for every browser and system this guide covers. Open the one you use.
Manual removal using Safe Mode
Important! →
Manual removal guide might be too complicated for regular computer users. It requires advanced IT knowledge to be performed correctly (if vital system files are removed or damaged, it might result in full Windows compromise), and it also might take hours to complete. Therefore, we highly advise using the automatic method provided above instead.
Step 1. Access Safe Mode with Networking
Manual malware removal should be best performed in the Safe Mode environment.
Windows 7 / Vista / XP
- Click Start > Shutdown > Restart > OK.
- When your computer becomes active, start pressing F8 button (if that does not work, try F2, F12, Del, etc. - it all depends on your motherboard model) multiple times until you see the Advanced Boot Options window.
- Select Safe Mode with Networking from the list.
Windows 10 / Windows 8
- Right-click on Start button and select Settings.
- Scroll down to pick Update & Security.
- On the left side of the window, pick Recovery.
- Now scroll down to find Advanced Startup section.
- Click Restart now.
- Select Troubleshoot.
- Go to Advanced options.
- Select Startup Settings.
- Press Restart.
- Now press 5 or click 5) Enable Safe Mode with Networking.
Step 2. Shut down suspicious processes
Windows Task Manager is a useful tool that shows all the processes running in the background. If malware is running a process, you need to shut it down:
- Press Ctrl + Shift + Esc on your keyboard to open Windows Task Manager.
- Click on More details.
- Scroll down to Background processes section, and look for anything suspicious.
- Right-click and select Open file location.
- Go back to the process, right-click and pick End Task.
- Delete the contents of the malicious folder.
Step 3. Check program Startup
- Press Ctrl + Shift + Esc on your keyboard to open Windows Task Manager.
- Go to Startup tab.
- Right-click on the suspicious program and pick Disable.
Step 4. Delete virus files
Malware-related files can be found in various places within your computer. Here are instructions that could help you find them:
- Type in Disk Cleanup in Windows search and press Enter.
- Select the drive you want to clean (C: is your main drive by default and is likely to be the one that has malicious files in).
- Scroll through the Files to delete list and select the following:
Temporary Internet Files
Downloads
Recycle Bin
Temporary files - Pick Clean up system files.
- You can also look for other malicious files hidden in the following folders (type these entries in Windows Search and press Enter):
%AppData%
%LocalAppData%
%ProgramData%
%WinDir%
After you are finished, reboot the PC in normal mode.
From our report of Dec 2018 · not reviewed since
Remove Christmas tree virus from a system with anti-malware tools
For the best results of Christmas tree virus removal, you need to employ reputable anti-malware tools like , , or any antivirus of your choice.
This is the best tip we can give you on this type of malware attacks. Especially important is to keep antivirus up-to-date when you constantly browser online shopping websites and other commercial pages.
Various redirects from those sites can lead to malicious pages and cyber infections. Remember to remove Christmas tree virus from the device before anything else because your private information may get exposed due to the malware infection. Hackers and other cybercriminals can access various account credentials.
[GI=method-1]You may need to reboot the device in Safe Mode with networking for antivirus tools to work properly
[GI=method-2]Perform Christmas tree virus removal with System restore feature and restore the device to a previous state
After removal and prevention
Make the next attack harmless
Christmas tree virus could only hurt the files that had no second copy, and the signs (christmas tree virus in the list of installed apps) showed exactly which ones those were. The 3-2-1 rule fixes that:
- three copies
- two media
- one disconnected
A practical version for a home PC: OneDrive or another cloud backup with version history, plus an external disk that you plug in once a week for File History and then unplug. Test a restore now and then by opening a few files from the backup on another device.
Details, schedules and what not to back up are in our 3-2-1 backup guide for Windows.
Access your website securely from any location
When you work on the domain, site, blog, or different project that requires constant management, content creation, or coding, you may need to connect to the server and content management service more often. The best solution for creating a tighter network could be a dedicated/fixed IP address.
If you make your IP address static and set to your device, you can connect to the CMS from any location and do not create any additional issues for the server or network manager that needs to monitor connections and activities. VPN software providers like can help you with such settings and offer the option to control the online reputation and manage projects easily from any part of the world.
Recover files after data-affecting malware attacks
While much of the data can be accidentally deleted due to various reasons, malware is one of the main culprits that can cause loss of pictures, documents, videos, and other important files.
More serious malware infections lead to significant data loss when your documents, system files, and images get encrypted. In particular, ransomware is is a type of malware that focuses on such functions, so your files become useless without an ability to access them.
Even though there is little to no possibility to recover after file-locking threats, some applications have features for data recovery in the system. In some cases, can also help to recover at least some portion of your data after data-locking virus infection or general cyber infection.
Questions about Christmas tree virus
Is Christmas tree virus a virus?
Most programs that appear the way Christmas tree virus did are not viruses in the strict sense. They are potentially unwanted programs:
- real software that arrives bundled with other downloads and then shows offers
- changes browser settings
- starts with Windows
Some are harmless, some are annoying and a few carry adware. What makes it worth removing is that you did not choose it.
Uninstall it from Installed apps and check the startup list and the browsers for anything added the same day. If it refuses to uninstall or returns after a restart, treat it as more serious and run a Microsoft Defender offline scan.
Christmas tree virus came back after I uninstalled it. Why?
Something else is reinstalling it. Common causes are a second program from the same publisher, a scheduled task that downloads it again, or a browser extension that keeps prompting for it. Sort Installed apps by install date and uninstall each entry from the same day that you did not choose.
Then open Task Scheduler and look in the Task Scheduler Library for tasks with updater-style names that you do not recognise. Check Startup apps in Task Manager too. If Christmas tree virus still returns, start Windows in Safe Mode, uninstall it there and run a Microsoft Defender offline scan, which looks for loaders that ordinary scans can miss.
Do I need to reinstall Windows to get rid of Christmas tree virus?
Usually not. A thorough clean-up is enough when the offline scan finds nothing afterwards and you do not see christmas tree virus in the list of installed apps again. A reset is the safer choice if an attacker had remote control, if security tools were switched off, or if detections come back after every clean-up.
Windows 11 can reset itself without a USB stick under Settings > System > Recovery > Reset this PC. Copy documents and photos out first and scan the copies. A reset does not change passwords or undo stolen data, so the account steps still apply.
Is it enough to quarantine Christmas tree virus?
Quarantine stops the file from running, which is the main point. It is not the whole clean-up, though. Malware rarely consists of one file: there may be a scheduled task, a startup entry, a second copy or a payload that was installed later.
Run a full scan and the offline scan, check Task Scheduler and Startup apps for unfamiliar entries, and follow the plan in this guide. Never restore an item from quarantine unless you are certain it was a false alarm.
What is Christmas tree virus?
From the reports we have, Christmas tree virus is a worm. The one sign people describe is christmas tree virus in the list of installed apps, and that pattern fits malware that runs hidden on Windows for someone else's benefit.
No sample has been analysed in public yet, so we do not name a family or a coin and we do not guess at extra features. What matters for you is that it is not a Windows component and not something you installed on purpose.
The steps in this guide remove it whatever the details turn out to be: find what starts it, remove that, scan offline and check what may have arrived with it. We update this page when an analysis appears.
Windows Security keeps finding Christmas tree virus again. Why?
Something is reinstalling it. Common causes are a scheduled task that downloads it again, a second program from the same source, an infected USB drive that is plugged in regularly, or another infected PC on the same network. Remove the detection, then check Task Scheduler, Installed apps sorted by date and every connected drive.
Run the offline scan with all USB drives unplugged. If the detection still comes back, resetting Windows is often faster than continuing the search. Copy only documents and photos before a reset.
Is my phone or my other laptop at risk from Christmas tree virus?
Other Windows PCs can be, if they shared drives, folders or downloads with the infected one. Scan them with a full scan and the offline scan. Phones are not affected by Windows malware of this kind, but accounts you use on them are, if passwords were stolen from the PC.
That is why the account steps matter even when only one computer was infected. Change important passwords from a clean device and turn on two-step verification. Scan external disks used on the infected PC as well.
How did Christmas tree virus get on my computer?
The route for Christmas tree virus is not documented yet. Malware that shows christmas tree virus in the list of installed apps usually arrives with something you ran yourself:
- a cracked program or game cheat
- a free tool from a mirror site
- a fake installer found through a search ad
- a file on a USB drive
Some infections are dropped later by a loader that was already on the PC. To find your source, sort Installed apps by install date and look at the Downloads folder for the days before the sign appeared. Remove that item as well; otherwise the same infection may come back after the clean-up.
Should I format my USB stick?
Formatting removes everything, including the worm, so it is the surest option for a stick with nothing important on it. If the drive holds files you need, scan it on a cleaned PC first, make hidden items visible in File Explorer, copy your files off, and then format it.
Do not open any shortcut on the drive before the scan. After formatting, scan the copied files once more before you put them back. A quick format is enough for a stick; it removes the hidden copies of the worm.
Will Fortect remove Christmas tree virus?
Fortect scans Windows for malware and unwanted programs and repairs the system files and settings they change, and its free scan shows what it finds on your PC before you decide anything.
For Christmas tree virus, follow the plan above as well: the browser steps take back permissions and settings that no scanner treats as a threat, and uninstalling the program that brought it removes the source.
Run Microsoft Defender's full scan and, if anything was found, its offline scan as a second opinion. If the symptoms are gone after the plan and both scans are clean, there is nothing more to do.
Sources
- Wikipedia: Computer worm (read October 6, 2026)
- FTC: How to recognize, remove and avoid malware (read October 6, 2026)
- Microsoft Learn: Microsoft Defender Offline (read October 6, 2026)
- Microsoft Learn: How Microsoft names malware (read October 6, 2026)