Terminating Apps

By Ryan Naraine  |  Posted 2004-12-15 Print this article Print

European anti-virus company F-Secure released a separate Zafi-D advisory with a warning that a payload is capable of terminating any application that has the words "firewall" or "virus" in it. If an anti-virus application is found on the infected machine, the virus attempts to overwrite those files with a copy of itself.

"Several Windows tools, like Task Manager, Registry Editor are disabled when the worm is active. Zafi.D opens these files with exclusive locking to prevent anything else from opening them," F-Secure warned.

Click here to read about a Playboy virus with a dangerous backdoor.
According to Sophos Cluley, the worm also has a dangerous backdoor component that listens on port 8181 and can be used by the unknown virus writer to upload and execute malicious code on infected computers.

"At the moment, were seeing a concentrated burst and its causing quite a nuisance," Cluley said. "The sneaky thing here is the backdoor component that can turn an infected computer into a zombie machine."

Trend Micro and McAfee, in separate alerts, described Zafi-D as "medium risk" although distribution remains "high."

David Perry, director of education at Trend Micro, said the worms peer-to-peer component has caused problems on corporate mail networks. "This presents a blended threat because its trying to connect to port shares and network drives. Its generating Internet traffic and clogging e-mail networks," he said.

Perry said the speed of the worms propagation underscores the need for education in workplaces and among consumers. "A lot of people, around this time of the year, unfortunately fall for this type of social engineering trick. Computer users should always be suspicious of electronic cards from unknown senders, especially if it comes with an attachment."

Sophos Cluley said it was not the first time that virus writers have used the Christmas season to dupe computer users. "In recent years, weve seen viruses coming in as Santa Claus screensavers or Christmas carols. Weve seen them use the names of female celebrities, so this is quite typical," he said.

"Whenever a mail comes with an attachment, you should be automatically suspicious. Not only at Christmastime, but every day of the year," Cluley added.

Check out eWEEK.coms for the latest security news, reviews and analysis. And for insights on security coverage around the Web, take a look at eWEEK.com Security Center Editor Larry Seltzers Weblog.


Submit a Comment

Loading Comments...
Manage your Newsletters: Login   Register My Newsletters

Rocket Fuel