p2pnet.net Virus News:- There’s no Yo-Ho in a new email worm that’s spreading bad-cheer disguised as a Christmas greeting.

W32/Zafi-D, thought to have originated in Hungary, spreads an attached file in emails offering seasonal greetings, says Sophos, continuing:

“The emails can use a variety of different languages including English, French, Spanish and Hungarian. Emails can contain messages as ‘FW: Merry Christmas’, ‘Happy HollyDays!’ and ‘Feliz Navidad!’.”

Inside is a crude animated .gif of two ‘smiley’ faces.

F-Secure gives it a Radar Alert Level 2 rating and says Zafi.D’s Christmas messages are attached as .pif, .cmd, .bat, .com or .zip files.

"It can display a decoy message in message box saying ‘Error in packed file’!," says F-Secure, pointing out that the worm uses its own SMTP engine to send emails with infected attachments, and can use different SMTP relays, depending on the language.

===================

See:-
bad-cheer - Latest Zafi worm spreading in the wild as email Christmas greeting, Sophos, December 14, 2004
Alert Level 2 – Zafi.D, F-Secure, December 14, 2004

This entry was posted on Tuesday, December 14th, 2004 at 10:00 pm and is filed under Uncategorized. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.

HOME

Viewed 4483 times