IRON
16-12-2004, 11:07 PM
موضوع الرسالة : VIRUS ADVISORY - W32/Zafi.d@MM
What is it?
Offering a fake holiday greeting, W32/Zafi.d@MM is a Medium Risk mass-mailing worm that arrives as an email attachment. When run, the worm displays a fake error message (Error in packed file!), infects the host computer and emails itself to stolen email addresses using the infected computer's Internet connection.
Like previous variants, the worm sends itself in different languages depending on the recipient's address. For example, a .COM mail address receives an English message, a .DE mail address receives German.
Note: To fortify your anti-virus defense against threats like W32/Zafi.d@MM that need Internet access to spread, we recommend installing McAfee Personal Firewall Plus.
What should I look for?
FROM: Varies (forged addresses taken from infected system)
SUBJECT: Example: Fw: Merry Christmas!
BODY: Example: Happy Hollydays!
ATTACHMENT: Example: postcard.php8583.zip
How do I know if I've been infected?
Fake error message displayed. Alerts from a desktop firewall (if installed) that a new application is asking for Internet access. TCP port 8181 open on the infected system.
What is it?
Offering a fake holiday greeting, W32/Zafi.d@MM is a Medium Risk mass-mailing worm that arrives as an email attachment. When run, the worm displays a fake error message (Error in packed file!), infects the host computer and emails itself to stolen email addresses using the infected computer's Internet connection.
Like previous variants, the worm sends itself in different languages depending on the recipient's address. For example, a .COM mail address receives an English message, a .DE mail address receives German.
Note: To fortify your anti-virus defense against threats like W32/Zafi.d@MM that need Internet access to spread, we recommend installing McAfee Personal Firewall Plus.
What should I look for?
FROM: Varies (forged addresses taken from infected system)
SUBJECT: Example: Fw: Merry Christmas!
BODY: Example: Happy Hollydays!
ATTACHMENT: Example: postcard.php8583.zip
How do I know if I've been infected?
Fake error message displayed. Alerts from a desktop firewall (if installed) that a new application is asking for Internet access. TCP port 8181 open on the infected system.