E-Card Holiday Virus Packs Ugly Punch

A new virus strain masquerading as electronic Christmas cards is accounting for one in every 10 e-mails hitting in-boxes, security experts warned Wednesday.

The W32/Zafi-D worm, which originated in Hungary, is using mass-mailing and P2P (peer-to-peer) techniques to squirm through in-boxes and slow network traffic to a crawl.

The worm, which poses as a Christmas greeting, has the ability to replicate in as many as 19 languages, which makes it a “very serious threat” to computer users worldwide, said Graham Cluley, a senior technology consultant at Sophos Inc.

Cluley told eWEEK.com the Zafi-D mutant accounts for 75 percent of all virus reports at coming into the company’s monitoring stations in the past 24 hours.

A spokeswoman for e-mail security services firm MessageLabs said the company had intercepted more than 1 million copies of Zafi-D since it first started squirming Tuesday.

“This one is spreading far and wide because it uses multiple languages. The worm has been programmed to change its disguise and communicate in the language of the target. That makes it a bigger threat,” Cluley said.

According to a Sophos advisory, the worm arrives with the subject line “Merry Christmas,” “Buon Natale!” or “Joyeux Noel!,” depending on the location of the recipient.

The body of the e-mail contains a “Happy Hollydays” greeting in green text with a yellow emoticon. The virus arrives as an attachment with the following extensions: ZIP, CMD, PIF, BAT or COM.

Once executed, Zafi-D copies itself to the Windows system folder with the filename “Norton Update.exe.” It then creates a number of files in the Windows system folder with filenames consisting of eight random characters and a DLL extension.

The worm has been programmed to harvest e-mail addresses from the Windows Address Book.

Next Page: A payload can terminate any application including the words “firewall” or “virus,” F-Secure reports.

European anti-virus company F-Secure released a separate Zafi-D advisory with a warning that a payload is capable of terminating any application that has the words “firewall” or “virus” in it. If an anti-virus application is found on the infected machine, the virus attempts to overwrite those files with a copy of itself.

“Several Windows tools, like Task Manager, Registry Editor are disabled when the worm is active. Zafi.D opens these files with exclusive locking to prevent anything else from opening them,” F-Secure warned.

Click here to read about a ‘Playboy’ virus with a dangerous backdoor.

According to Sophos’ Cluley, the worm also has a dangerous backdoor component that listens on port 8181 and can be used by the unknown virus writer to upload and execute malicious code on infected computers.

“At the moment, we’re seeing a concentrated burst and it’s causing quite a nuisance,” Cluley said. “The sneaky thing here is the backdoor component that can turn an infected computer into a zombie machine.”

Trend Micro and McAfee, in separate alerts, described Zafi-D as “medium risk” although distribution remains “high.”

David Perry, director of education at Trend Micro, said the worm’s peer-to-peer component has caused problems on corporate mail networks. “This presents a blended threat because it’s trying to connect to port shares and network drives. It’s generating Internet traffic and clogging e-mail networks,” he said.

Perry said the speed of the worm’s propagation underscores the need for education in workplaces and among consumers. “A lot of people, around this time of the year, unfortunately fall for this type of social engineering trick. Computer users should always be suspicious of electronic cards from unknown senders, especially if it comes with an attachment.”

Sophos’ Cluley said it was not the first time that virus writers have used the Christmas season to dupe computer users. “In recent years, we’ve seen viruses coming in as Santa Claus screensavers or Christmas carols. We’ve seen them use the names of female celebrities, so this is quite typical,” he said.

“Whenever a mail comes with an attachment, you should be automatically suspicious. Not only at Christmastime, but every day of the year,” Cluley added.

Check out eWEEK.com’s for the latest security news, reviews and analysis. And for insights on security coverage around the Web, take a look at eWEEK.com Security Center Editor Larry Seltzer’s Weblog.