Christmas worm speaks in many tongues

A new worm with a Christmas message has been detected as it began spreading around the world this afternoon.

Zafi D, originally designed by Hungarian programmers, arrives with the subject line 'Happy Christmas'. However, the mutant version of the infection has become multilingual, appearing in English, Italian, Spanish, Russian, Swedish and several other languages.

Once the .pif, .cmd, .bat, .com or .zip file attachment is opened the worm copies itself to the Windows System Directory with a random .dll name and 'Norton Update.exe'. The .exe file is added to the registry key.

Zafi D then harvests email addresses and sends itself on to entries in the host address book. But in a stealthy move, email addresses featuring the names of antivirus companies are not touched.

The worm also shuts down any firewall or antivirus applications and overwrites them with copies of itself. Windows tools like task manager and registry editor are also disabled. The worm also spreads via peer-to-peer file sharing software as a 11,745-byte file.

Five antivirus vendors have identified the virus to date and protection should be available for download.