| Tannenbaum | |
|---|---|
| Type | File virus |
| Creator | |
| Date Discovered | 1990.03 |
| Place of Origin | Altena, Germany |
| Source Language | |
| Platform | DOS |
| File Type(s) | .com |
| Infection Length | 1,539 bytes |
| Reported Costs | |
Tannenbaum, also known as Christmas Tree or XA1 is a slightly polymorphic .com infector from 1990. It displays a Christmas Tree when executed from December 24 to 31.
Behavior
When executed, Tannenbaum infects all files in the current directory and all files listed in the PATH variable. It moves a 1,539-byte-sized portion of the beginning file to the end and overwrites the original portion. If the file is smaller than 1,539 bytes, Tannenbaum will add extra junk code to it to make it that large.
Between December 24 and 31, it displays an ASCII Christmas Tree and a German text translating to "And It's still alive: The Christmas Tree!. Merry Christmas…" when an infected file is executed. On April 1, it writes a small program to the master boot record which displays the text "April, April …" upon reboot. This may cause the system to hang.
Other Facts
Some sources claim the Christmas Tree payload activates as early as December 21. Our own tests only show it activating on and after the 24th. Other viruses and worms have displayed ASCII Christmas Trees, including Vienna variant Vienna.Choinka and the Christmas tree worm.
Use of holidays, particularly Christmas, was a relatively common thing with viruses and worms. Sometimes it was a social engineering tactic, and in cases like this one, it was simply a joke. Other Christmas-themed viruses and worms include Christmas tree and Japanese Christmas.
Sources
F-Secure Antivirus, F-Secure Virus Descriptions : XA1.
Kaspersky Lab. SecureList.com, Virus.DOS.Christmas.1539.a.
Christoph Fischer. RZ Universitaet Karlsruhe, Micro-BIT Virus Center, XA1 Virus. 1990.03.16
Vesselin Vladimirov Bontchev. Virus-L Digest, VIRUS-L Digest Thursday, 22 Sep 1994 Volume 7 : Issue 76. 1994.08.26