Multilingual worm spreads throughout Europe

A new multilingual worm from Hungary hit networks over the weekend and is spreading steadily.

Zafi.B, also known as Erkez.b or Hazafi, spreads via peer-to-peer software and as a 12,800 byte .pif attachment within emails.

It has the potential to spread widely as it mails itself out in Hungarian, English, Italian, Spanish, Russian and Swedish.

"We got a lot of this at the weekend. 58 per cent of all our returns are this worm," said Graham Cluley, senior analyst at Sophos. "Some people are not suspicious of non-English viruses, so that could be helping it spread."

Once activated the worm copies itself into the registry file and starts harvesting email addresses and mailing itself forward using its own SMTP engine.

Zafi.B also terminates any application that has 'firewall' or 'virus' in its filename and several Windows tools, like Task Manager and Registry Editor.

Its predecessor, Zafi.A, surfaced in April but had little impact outside Hungary as it only sent itself to .hu addresses.

The motivation for the writer appears to be political in both cases. Zafi.B contains code urging the Hungarian government to accommodate the homeless and bring back the death penalty.