Christmas virus (Removal Guide) - Free Instructions

What is Christmas virus?

Christmas virus is a set of cyber infections that are related to festive period

Christmas Virus - a term used to describe cyber infections and scams that are related to festive season.

Christmas virus is a term used to describe multiple different cyber threats that are related to Christmas. Therefore, the array of infections can vary, including worms, ransomware, trojans, as well as social engineering^[1] attacks via emails and social networks. The variety of viruses have a different goal, but, nevertheless, most of them are malicious and should be avoided at all costs. The majority of Christmas viruses are spread with the help of spam emails, although other propagation methods, like fake updates, can be used as well. In this article, we will go through most common Christmas-themed malware and ways to avoid it.

Because the term describes multiple different infections, there are different ways of dealing with it. However, the best way to remove Christmas virus is by employing reputable security software that can detect and clean the system from malicious software. We highly recommend using FortectIntego or SpyHunter 5Combo Cleaner for the job, although any other powerful anti-malware tool should do the job.

Some infections, such as ransomware, leave the devastation behind, even after victims remove Christmas virus. Ransomware locks up personal data and demands a ransom to be paid for its release. Thus, file recovery needs to be performed in order to get access to the encoded data.

Below are some of the examples of Christmas virus, and we hope that you will be able to protect your privacy and online security this Christmas with the help of this article!

Christmas-themed malware examples

Christmas Tree EXEC

The very first holiday season malware appeared back in 1987 when a German student who initially claimed that he only wanted to wish Season's Greetings to friends. The worm, written in Rexx language,^[2] used to be sent to an inbox with the subject line “Let this exec run and enjoy yourself!”, and, once the victim typed CHRISTMAS as instructed, the virus sent drew a Christmas Tree as text graphics, and sent out its copies to everybody in the target's contact's file. Ultimately, the Christmas Tree EXEC worm managed to paralyze international networks, and some 350,000 machines were shut down by IBM.

WM97/Melissa-AG or Prilissa

Prilissa is one of the old Christmas viruses, that was first detected back in 1999. It is as well propagated with the help of spam emails with the subject line “Message from [username].” The malicious DOC file, once executed, infects the machine with malware that would trigger on 25th of December.

Prilissa opens pop-up windows, inserts randomly colored squares into the opened MS Word document, and attempts to wipe out the C: drive upon next reboot.

The Maldal virus

The Maldal virus was injected into victims' machines once they opened a Christmas.exe file. The phishing email came with “Happy New Year” subject line and seemed like a Season's Greetings electronic card, which most people fell for.

Once executed, the malware opened a window that displayed a Santa Claus with a reindeer, sliding on his skis with a message at the bottom:

From the heart, Happy new year!

Koobface worm

Koobface malware was targeting users of social networks like Facebook, Skype, Twitter, and redirected victims to a spoofed Santa-themed web page. Soon after the infiltration, it starts its malicious activity – it is capable of stealing login information of various accounts, as well as banking information, which can result in money loss for victims.

Additionally, Koobface forms a peer-to-peer botnet^[3] that propagates the malware even further.

MerryChristmas ransomware

MerryChristmas ransomware has been actively propagated with the help of malicious email attachments

MerryChristmas ransomware is a file locking virus, as well as data stealing malware^[4] that first appeared in January 2017. While it is strange that malware with such name appeared in January, it is believed that it is of Orthodox origin, as Christmas is celebrated on 7th of January.

The virus was distributed with the help of spam campaign – one came from the alleged Federal Trade Commission, while the other one pretended to be a notice from the court. The email embedded a hyperlink that downloaded a zip file disguised as a PDF document.

As soon as the machine gets infected, all personal videos, music, pictures and similar files are encoded, and an appendix is added. Additionally, users can view a ransom note that shows Santa Claus from Futurama and displays a timer. Allegedly, after it expires and no payment in Bitcoin will be transferred, all the data on the machine will be erased. Nevertheless, users should not pay the ransom and instead use official decryptor that is available to download on our main article page.

Stay away from Christmas gift and similar scams

Low profile cyber criminals and people who want an easy profit often rely on scams. The following are most prominent Christmas virus scams that should not be overlooked this Christmas.

Christmas Day Bonus Gift email virus

Christmas Day Bonus Gift email virus is a spam email campaign that aims to distribute a data-stealing trojan Ursnif.

Users receive an email into their inboxes that claims that they are entitled to a Christmas bonus. In order to claim it, they are meant to click on a provided link. As soon as they click on the link, they are led to a Google doc, which is an executable file. Once executed, it will install Ursnif trojan that can record keystrokes, system information, and other sensitive data.

The Secret Sister Gift Exchange scam

This Christmas scam has been active since 2015,^[5] and it seems like it is not going away three years later. The hoax is prevalent on social media platforms like Facebook or Twitter. It operates a “pyramid scheme.” It promises that you will be able to receive 36 gifts in exchange for just one. While it sounds too good to be true, it really is.

In reality, it is merely a scam that asks victims to send $10 via the spoofed website. Do not participate in The Secret Sister Gift exchange scam, and rather buy presents who you actually care about this festive season.

Secret Sister exchange scam has been around since 2015, and it seems to be back every year

Amazon scams

Amazon scams, such as Amazon Gift Card, Amazon Membership Rewards, Congratulations Amazon User and many others, are designed to trick people into either providing sensitive information that can be used for marketing purposes, or installing bogus software, subscribing for useless services, and such. Ultimately, users end up wasting money and simply being scammed by cyber crooks.

The most recent Amazon scam which you might encounter while shopping for presents is masked as an email coming from the industry giant itself. Allegedly, users are informed that a Prime membership was purchased, and, in order to cancel it, they have to log in using their Amazon account credentials. As evident, bad actors' goal is to get access to the official account.

Extortion scams

Extortion scams have been extremely prevalent since mid-2018, and the number of users reporting these incidents increased drastically. Initially, sextortion scams were employed for blackmail. The crooks claim that they injected malware into the targeted computer, which allowed them to record users via the camera while they were watching porn online.

Crooks typically use information that was obtained from previous data breaches (such as email address and password) to make the hoax email more believable. Malicious actors ask users to pay a certain amount of Bitcoin, or else the recorded shameful videos would be sent to victims' friends and family.

The most recent scam evolves bomb threats and asks users to pay as much as $20,000 in order to save hundreds of people from bomb's detonation.^[6]

Christmas virus distribution methods

As evident, the main culprit in Christmas virus distribution is the fake emails. Users are sometimes redirected to a malicious website via a hyperlink or click on an attachment that holds macro scripts. We suggest you follow these simple tips if you want to avoid being tricked by a phishing email:

• Do not jump into the email contents straight away. First, example the email address of the sender, as well as the subject line. These two simple checks might straight away disclose the deception. For example, an email from customer.support@amazonn.com might be easily interpreted as an original one.
• The contents of the email might look very legit, with correct logos and formatting. However, make sure you carefully read through it and make some conclusions. You can ask yourself these questions: “why did this company send me an email? was I expecting it?.” In some cases, you will answer yes, but then you should proceed with the more advanced examination.
• Phishing emails usually contain a link or n attachment that might be disguised as a .pdf, .doc, .txt, .html, and other documents. Before opening them, make sure you scan them using reputable security software.
• When it comes clicking on hyperlinks, hover your mouse over it and see where it is actually bringing you.
• Call the company that is trying to contact you or go to the official website, and use the email address provided there.

All in all, experts advise users to be vigilant, and always go by the rule “If it is too good to be true, it probably is.”

Christmas virus is a set of cyber infections and scams that try to abuse the good mood people have during Christmas and gain money

Get rid of Christmas virus and protect yourself from cyber infections in the future

In most cases, scamming attempts can be noticed straight away, as fake messages are usually littered with grammar and spelling mistakes, or terrible formatting. However, some hoax messages sent via Facebook or other platforms might seem legitimate, and some people might fall for the trick. To avoid such consequences, we suggest you search online for the information. Simply copy the first line of the email or message and search for it. There will be plenty of blogs, forums posts, articles, and similar data regarding the threat.

Do not forget that scam messages often trick users into installing viruses. In such a case, Christmas virus removal must be performed. However, because Christmas malware can be related to so many different threats, it's elimination instructions can differ. Nevertheless, the most optimal solution would be scanning your machine with security software like FortectIntego, SpyHunter 5Combo Cleaner, or Malwarebytes. The scans will find any malicious files embedded into the system and safely eliminate them.

In some cases, you can remove the Christmas virus manually. In case you installed bloatware^[7] like Power System Care, MyShopcoupon, Safe PC Cleaner, and similar, you can get rid of all the files manually via the Control Panel (Windows) or Applications folder (macOS). Additionally, you might have to reset each of the affected browsers, such as Google Chrome, Internet Explorer, Mozilla Firefox, Safari, Opera, or others.

Nevertheless, if you are dealing with a severe Christmas virus infection, you should enter Safe Mode with Networking in case malware is interfering with AV engine's operation. Follow the instructions below.