Son Of Zafi Email Worm Attacks Hungarian Prime Minister

Anti-virus experts at Sophos have detected a new email worm which attempts to knock the website of the newly appointed Hungarian Prime Minister off the internet. The worm also targets the Google and Microsoft websites.

The Zafi-C worm (W32/Zafi-C) spreads via email using subjects lines such as ‘Re: Hey buddy!’ and ‘Re: very sick little girl!’ in an attempt to lure users into launching its malicious attachment. If users run the attached file, it can launch a distributed denial of service attack against the website of the Prime Minister of Hungary. Sophos believes the virus may have been motivated by the millionaire businessman Ferenc Gyurcsany forming a government in Hungary earlier this month.

“Each new version of the Zafi worm we see has become more sophisticated and more malicious in its intent,” said Graham Cluley, senior technology consultant for Sophos. “The good news is that at the moment Zafi-C is not spreading at anything like the rate of its predecessor, but companies should still ensure they keep their anti-virus up-to-date and practise safe computing at all times.”

The previous version of the Zafi worm, Zafi-B, has continued to spread widely since June with a message calling for the death penalty to be introduced in Hungary.

“The Hungarian author of the Zafi worm has been very successful in the past in spreading his viruses – all of which have a political message,” continued Cluley. “Hopefully computer users are becoming more suspicious of unsolicited emails and are more vigilant about protecting their PCs from attack.”

As well as the Zafi family of worms, several other viruses have spread a political message, including the Quaters worm which launched a scathing attack on Tony Blair and attempted to knock the Downing Street website off the internet.

Further information about Zafi-C can be found at:
www.sophos.com/virusinfo/analyses/w32zafic.html