Latest Zafi Worm Spreading In The Wild As Email Christmas Greeting

Anti-virus experts at Sophos have detected a new in-the-wild worm which spreads via email disguised as a Christmas greeting. The W32/Zafi-D worm (W32/Zafi-D), which is believed to have been written in Hungary, spreads as an attached file inside emails offering seasonal greetings to the recipient.

The emails can use a variety of different languages including English, French, Spanish and Hungarian and contain messages such as ‘FW: Merry Christmas’, ‘Happy HollyDays!’ and ‘Feliz Navidad!’. Embedded inside the email is a crude animated GIF graphic of two ‘smiley’ faces.

If the attached viral file is launched, the Zafi-D worm displays an error message (‘CRC: 04F6Bh Error in packed file!’) in an attempt to fool the user that it was simply a program that has failed to work properly. In reality, users who see this message will find that their PCs have become infected.

“Despite its disguise, Zafi-D isn’t much of a Christmas present – users who open the attached file will trigger the virus into action, infecting their PC and potentially opening it up to hacker attack,” said Graham Cluley, senior technology consultant for Sophos. “Heartless hackers and virus writers can attack at any time of year, and every computer user should be on the lookout for unusual emails and be wary of ever opening any unsolicited file they are sent via email.”

Sophos advises companies to be as suspicious during the holiday season as they would be at any other time of the year.

“Having a business environment where it’s seen to be acceptable to send and receive joke programs, screensavers, and electronic greetings cards increases the risk of virus infection at any time – but can prove particularly risky during the holiday season,” continued Cluley. “When your computer data is at risk it may be wiser to avoid electronic wellwishing, and use paper and ink instead.” Further details about Zafi-D can be found at: