E-Card Holiday Virus Packs Ugly Punch
By Ryan Naraine
December 15, 2004
A new virus strain masquerading as electronic Christmas cards is
accounting for one in every 10 e-mails hitting in-boxes, security experts
The W32/Zafi-D worm, which originated in Hungary, is using mass-mailing
and P2P (peer-to-peer) techniques to squirm through in-boxes and slow
network traffic to a crawl.
The worm, which poses as a Christmas greeting, has the ability to
replicate in as many as 19 languages, which makes it a "very serious
threat" to computer users worldwide, said Graham Cluley, a senior
technology consultant at Sophos Inc.
Cluley told eWEEK.com the Zafi-D mutant accounts for 75 percent of all
virus reports at coming into the company's monitoring stations in the past
A spokeswoman for e-mail security services firm MessageLabs said the
company had intercepted more than 1 million copies of Zafi-D since it
first started squirming Tuesday.
"This one is spreading far and wide because it uses multiple languages.
The worm has been programmed to change its disguise and communicate in the
language of the target. That makes it a bigger threat," Cluley said.
According to a Sophos advisory, the worm arrives with the subject line
"Merry Christmas," "Buon Natale!" or "Joyeux Noel!," depending on the
location of the recipient.
The body of the e-mail contains a "Happy Hollydays" greeting in green text
with a yellow emoticon. The virus arrives as an attachment with the
following extensions: ZIP, CMD, PIF, BAT or COM.
Once executed, Zafi-D copies itself to the Windows system folder with the
filename "Norton Update.exe." It then creates a number of files in the
Windows system folder with filenames consisting of eight random characters
and a DLL extension.
The worm has been programmed to harvest e-mail addresses from the Windows
European anti-virus company F-Secure released a separate Zafi-D advisory
with a warning that a payload is capable of terminating any application
that has the words "firewall" or "virus" in it. If an anti-virus
application is found on the infected machine, the virus attempts to
overwrite those files with a copy of itself.
"Several Windows tools, like Task Manager, Registry Editor are disabled
when the worm is active. Zafi.D opens these files with exclusive locking
to prevent anything else from opening them," F-Secure warned.
According to Sophos' Cluley, the worm also has a dangerous backdoor
component that listens on port 8181 and can be used by the unknown virus
writer to upload and execute malicious code on infected computers.
"At the moment, we're seeing a concentrated burst and it's causing quite a
nuisance," Cluley said. "The sneaky thing here is the backdoor component
that can turn an infected computer into a zombie machine."
Trend Micro and McAfee, in separate alerts, described Zafi-D as "medium
risk" although distribution remains "high."
David Perry, director of education at Trend Micro, said the worm's
peer-to-peer component has caused problems on corporate mail networks.
"This presents a blended threat because it's trying to connect to port
shares and network drives. It's generating Internet traffic and clogging
e-mail networks," he said.
Perry said the speed of the worm's propagation underscores the need for
education in workplaces and among consumers. "A lot of people, around this
time of the year, unfortunately fall for this type of social engineering
trick. Computer users should always be suspicious of electronic cards from
unknown senders, especially if it comes with an attachment."
Sophos' Cluley said it was not the first time that virus writers have used
the Christmas season to dupe computer users. "In recent years, we've seen
viruses coming in as Santa Claus screensavers or Christmas carols. We've
seen them use the names of female celebrities, so this is quite typical,"
"Whenever a mail comes with an attachment, you should be automatically
suspicious. Not only at Christmastime, but every day of the year," Cluley