Christmas Tree app virus hoax spreads on Facebook

Filed Under: Facebook, Malware, Social networks

Thousands of Facebook users are warning each other about a Christmas Tree virus said to be spreading in the form of a rogue application on the social network.

The only problem with this warning? It's utterly bogus.

Warning messages about the Christmas Tree app virus

Here's a typical message being shared widely on Facebook:

WARNING!!!!!!.....DO NOT USE THE Christmas tree app. on Facebookplease be advised it will crash your computer. Geek squad says its oneof the WORST trojan-viruses there is and it is spreading quickly.Re-post and let your friends know. THANKS PLEASE REPOST!

Users believe they're doing the right thing when they share warnings like this - but unfortunately they haven't checked their facts. Although anyone could at any time create a rogue application with the name "Christmas Tree" of course, we're not aware of any malware which uses this disguise.

Furthermore, since when was Geek Squad a reliable source for information about new malware? Wouldn't you be more sensible to check with an established anti-virus company? A legitimate warning would at the very least have included some links to further information - such as a statement on Geek Squad's website.

Ironically, the hoax is probably spreading much faster than any of the genuine commonly encountered Facebook viruses at the moment.

Please don't share virus warnings with your online friends until you have checked them with a credible source (such as an established computer security company). Malware can be killed off fairly easily, but misinformation like this can live on for months, if not years, because people believe they are "doing the right thing" by sharing the warning with their friends.

If you're a regular user of Facebook, be sure to join the Sophos page on Facebook to be kept informed of the latest security threats.

PS. Those of you very long in beard may recall that in the late 1980s there was a real virus called "Christmas Tree" (also known as "CHRISTMA EXEC"). It displayed a crude picture of a Christmas Tree using the ASCII character set, and infected computers on IBM's internal network and other systems.

However, as this was way back in 1987 I'm pretty confident that this hasn't inspired the latest scare on Facebook!

, , ,

You might like

24 Responses to Christmas Tree app virus hoax spreads on Facebook

  1. Eric · 1744 days ago

    The following paragraph completely discredits this article: "Please don't share virus warnings with your online friends until you have checked them with a credible source (such as an established computer security company). Malware can be killed off fairly easily, but misinformation like this can live on for months, if not years, because people believe they are "doing the right thing" by sharing the warning with their friends."

    Better to be safe than sorry, IMO.

    • guest · 1375 days ago

      meh, I always think that the 'friend' reposting a blatant hoax is a dumb lemming, but whatevs.

  2. Joe · 1744 days ago

    It takes two seconds to send repost it. vs the five minutes to look up if its true, and who the hell is it hurting to repost it. Don't like it don't f**king read it.

    • Eric (Not the OP) · 1744 days ago

      So if you have 300 friends and they all spend 2 seconds to read and repost you have just wasted 10 minutes of your friends time (not to mention the tens of thousands of others it will eventually reach). Where you could have saved them all the trouble with only a couple minutes of yours.

      • TooLazt TooGetUp · 1374 days ago

        Stop being lazy it took me 5 seconds to type "Christmas Tree App Geek Squad" into Google and find an official statement made by GeekSquad saying they next release such information. It took me another 5 to reply to my friends post with the correct information. In the end my 10 seconds of time will save my 300 friends 2 seconds each from reposting a hoax saving a total of 600 seconds less my 10 = 590 seconds saving 9.83 minutes

    • Chris · 1743 days ago

      Joe, are you really that lazy? It took me about 5 seconds to look this up and find out that it was a hoax.

    • tacoMike · 1376 days ago

      I'm glad Joe isn't my friend. What a jerk.

  3. Justa · 1744 days ago

    Geesh Joe ~ relax dude.

  4. Matt · 1378 days ago

    Christmas is coming, and the warnings circulate again!

  5. shaz · 1375 days ago

    Yep I just corrected a friend who just posted it. The telltale signs are always there though... LOTS OF CAPITAL LETTERS AND LETS NOT FORGET ABOUT THE APOSTROPHES!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

  6. Hank · 1375 days ago

    Joe, people like you are the problem, it takes me less than 30 seconds to find out if one of these is real or not. If it is real I will post a new message with real info and a link, not copy-paste the overly dramatized spam like message and if it is fake I reply to the senders post with one or two links showing them it is fake. If someone keeps up with spreading spam (like you do) I call them out on being an idiot and if they keep it up they get blocked as that person must be to stupid to function in society and is not worth having as a friend.

  7. Patricia · 1375 days ago

    I say thank yall for posting this stuff. Seriously It takes less than 5 mins. to see if a posting going around facebook is real or not.. I would say have people gotten this lazy but the sheer fact of Joe's posting that is just proof that people are lazy. I'd rather take that extra time to see the facts then see the same posting 100 times in my feed. Graham you do an outstanding job with providing the information.. :)

  8. leanne · 1375 days ago

    I'd rather take the tiny bit of time to find the truth than anny any of my friends by spreading a hoax!! Doesn't take that long, don't be lazy and spread the crap!! Get the facts!!

  9. leanne · 1375 days ago

    I meant *annoy*

  10. Sharon · 1375 days ago

    Would have been nice to tell us novice computer users where to find out if its a hoax. Maybe a link or something.

  11. Ron G · 1375 days ago

    I find it better to correct the person who didn't look it up to see if it was real or hoax rather then someone correcting me and making me look like the fool who is spreading the hoax that is false.

  12. huey9k · 1375 days ago

    I had my doubts about the validity of the warning... then I saw the words "GEEK SQUAD". Of course, my immediate reaction was to go find the Christmas tree app, since ANYTHING Geek Squad says is total b*llsh*t. If Geek Squad said the sky was blue, I would look up and check.

  13. Kathleen · 1375 days ago

    I would think because Facebook is full of malware that any kind of awareness is better than no awareness at all. There is no sense in belittling someone who is at least thinking they could save someone from trouble. Since when is it worthy to not befriend someone who thinks they have others best intentions at heart. Geez people chill out there is way more harmful things out there to get worked up over than someone passing on information on Facebook.

  14. Sherylin · 1375 days ago

    Hi Sharon, Sopho's main Facebook page is a good place to start.

    Facecrooks is another.

    Just hit the "like" button for both if you haven't, already. I've enjoyed their timely warnings in my news feed for quite some time now.

  15. Imelda · 1375 days ago

    Sharon, you can always use the search engine on sophos, but seriously, with most hoaxes, all you have to do is google the words - in this case, Christmas tree virus Facebook - and you will find half a dozen sites giving you the straight info. As a rule of thumb, anything worded in a way that encourages panic and indiscriminate reposting is a hoax.

  16. Dave · 1375 days ago

    And of course, the sky is blue, because it's full of crap...

  17. I really appreciate those of you who calmly explain things and offer information on what to do when we come across things like this. How else are we supposed to know whether is is real or a hoax? You can "Google" something for information, but you can also get conflicting results. I have always tried to make others aware of such warnings I have come across, simply because I didn't want others to click on a link and have something terrible happen to their computer. Maybe I'm naive, or maybe I just want to think that everyone who posts a warning is actually concerned for the well-being of others. Either way, it's an honest gesture on my part, and I appreciate positive feedback, and helpful information. As for the rest of you, you aren't even worth checking back here to see your feedback from my post.

  18. Lilas · 640 days ago

    The damn thing is annoying. It pops up on FB almost daily, and there seems to be no way to block it.

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

About the author

Graham Cluley runs his own award-winning computer security blog at, and is a veteran of the anti-virus industry having worked for a number of security companies since the early 1990s. Now an independent security analyst, he regularly makes media appearances and gives computer security presentations. Follow him on Twitter at @gcluley