New Internet Worm Disguised as Electronic Christmas Card

Dec. 15, 2004
Bilingual e-card is successful in infecting computers using Zafi worm

HELSINKI -- Internet security experts warned Tuesday of a new virulent e-mail worm particularly successful in infecting computers as it is disguised as a multilingual electronic Christmas card.

"We think this worm will be big, because of its timing and the fact that it comes in 15 different European languages," Mikko Hyppoenen, head of anti-virus research at Finnish firm F-Secure, told AFP.

The virus, dubbed Zafi.D, is a traditional Internet worm infecting computers by e-mail and distributes itself by using e-mail lists on contaminated personal computers.

Its Christmas greeting is in the language of the recipient, decided by the country code -- like ".fi" or ".fr" -- at the end of the e-mail address, making it all the more dangerous, Hyppoenen pointed out.

It also opens a back door on infected PCs, making it possible for outsiders to use them to distribute unsolicited bulk e-mail advertisements, or spam, and launch malicious attacks to close down web sites, he added.

The earlier variants of the Zafi Internet worm family were highly dangerous viruses, with the B variant still among the top 10 most virulent bugs several months after it was launched, he said.

While this is the first Zafi worm disguised as a Christmas card, the phenomenon is not new, Hyppoenen said.

"We have seen these hoaxes for several Christmases already, and personally I prefer traditional pen and paper cards, and we recommend this to all our clients too."