E-Card Holiday Virus Packs Ugly Punch

E-Card Holiday Virus Packs Ugly Punch
( Page 1 of 2 )

That e-card bringing Christmas cheer is nothing but a nasty mass-mailing worm that could turn your PC into a zombie machine, anti-virus experts warn.A new virus strain masquerading as electronic Christmas cards is accounting for one in every 10 e-mails hitting in-boxes, security experts warned Wednesday.

The W32/Zafi-D worm, which originated in Hungary, is using mass-mailing and P2P (peer-to-peer) techniques to squirm through in-boxes and slow network traffic to a crawl.

The worm, which poses as a Christmas greeting, has the ability to replicate in as many as 19 languages, which makes it a "very serious threat" to computer users worldwide, said Graham Cluley, a senior technology consultant at Sophos Inc.

Resource Library:

Cluley told eWEEK.com the Zafi-D mutant accounts for 75 percent of all virus reports coming into the companys monitoring stations in the past 24 hours.

A spokeswoman for e-mail security services firm MessageLabs said the company had intercepted more than 1 million copies of Zafi-D since it first started squirming Tuesday.

"This one is spreading far and wide because it uses multiple languages. The worm has been programmed to change its disguise and communicate in the language of the target. That makes it a bigger threat," Cluley said.

According to a Sophos advisory, the worm arrives with the subject line "Merry Christmas," "Buon Natale!" or "Joyeux Noel!," depending on the location of the recipient.

The body of the e-mail contains a "Happy Hollydays" greeting in green text with a yellow emoticon. The virus arrives as an attachment with the following extensions: ZIP, CMD, PIF, BAT or COM.

Once executed, Zafi-D copies itself to the Windows system folder with the filename "Norton Update.exe." It then creates a number of files in the Windows system folder with filenames consisting of eight random characters and a DLL extension.

The worm has been programmed to harvest e-mail addresses from the Windows Address Book.

Next Page: A payload can terminate any application including the words "firewall" or "virus," F-Secure reports.

>>> More Network Security & Hardware Articles          >>> More By Ryan Naraine