Where's the early bird when you need it?
vnunet.com, 14 Dec 2004
A new worm with a Christmas message has been detected as it began spreading around the world this afternoon.
Zafi D, originally designed by Hungarian programmers, arrives with the subject line 'Happy Christmas'. However, the mutant version of the infection has become multilingual, appearing in English, Italian, Spanish, Russian, Swedish and several other languages.
Once the .pif, .cmd, .bat, .com or .zip file attachment is opened the worm copies itself to the Windows System Directory with a random .dll name and 'Norton Update.exe'. The .exe file is added to the registry key.
Zafi D then harvests email addresses and sends itself on to entries in the host address book. But in a stealthy move, email addresses featuring the names of antivirus companies are not touched.
The worm also shuts down any firewall or antivirus applications and overwrites them with copies of itself. Windows tools like task manager and registry editor are also disabled. The worm also spreads via peer-to-peer file sharing software as a 11,745-byte file.
Five antivirus vendors have identified the virus to date and protection should be available for download.
16 year-old Brit receives six-month suspended sentence for Randex worm
Zafi-D spreading rapidly around the world
Glamour model virus launches DoS attack against Chechen rebel websites
Have you got a burning desire to quiz experts from...
Figleaves founder argues platform-as-a-service vendor will emerge to shake up...
Do you agree?
Have your say on this article