Virus alert: New worm hits Europe

Link: All the latest virus news

The Zafi.B worm, also known as Erkez.b or Hazafi, spreads via peer-to-peer software and as a 12800 byte .PIF attachment within emails.

It has the potential to spread widely as it mails itself out in six languages; Hungarian, English, Italian, Spanish, Russian, Swedish

‘We got a lot of this at the weekend, 58% of all our returns are this worm,’ said Graham Cluley, senior analyst at Sophos.

‘Some people aren’t suspicious of non-English viruses so that could be helping it spread.’

Once activated the worm copies itself into the registry file and starts harvesting email addresses and mailing itself forward using its own SMTP engine. It also terminates any application that has ‘firewall’ or ‘virus’ in its filename and several Windows tools, like Task Manager and Registry Editor.

Its predecessor Zafi.A surfaced in April but had little impact outside Hungary as it only sent itself to .hu addresses.

The motivation for the writer appears to be political in both cases. Zafi.B contains code urging the Hungarian government to accommodate the homeless and bring back the death penalty.

Related reading

Life Belt with Computer Folders
HMRC banknotes