Christmas card virus strikes worldwide

Antivirus companies are warning of an internet worm, previously thought to be of little harm, which struck 10 of the Fortune 500 companies in the US on Friday.

According to Network Associates, Navidad, which appears to be an email Christmas card, is an internet worm that uses an email protocol to spread. The worm is also reported to be hitting companies in the UK, including a large media organisation.

Users become infected if they open the attachment Navidad.exe in an email. The worm, which originated in South America, will attempt to send itself to addresses in the user's in-box, not address box like the Love Bug.

When run, the worm displays an error message - UI. A blue eye icon appears in the system tray next to the clock in the lower right corner of the screen, and a copy of the Trojan is saved to the file 'winsvrc.vxd' in the Windows system directory.

Jack Clark, product manager at Network Associates, said users need to be aware that if they are infected with the virus, they need to do more than just download the antivirus update.

"It does require some manual intervention too," he said. "It won't delete files like the Love Bug, but it will scare some users, and the worse thing is that system administrators are going to have to come to a machine and manually remove it."

Clark said so far 10 of the US Fortune 500 have been hit by the virus, and warned that the situation would only get worse as the country continues to wake up.

"Unfortunately, people are likely to open something which looks like a Christmas card, especially at this time of year - 'tis the season to be spreading viruses," he added.

For further advice on how to remove the virus and protect against infection, visit: http://vil.nai.com/vil/virusChar.asp?virus_k=98881