New medium rated Worm Zafi.b, aka Erkez.b. 14/06/04

This new highly polymorphic worm has just been escalated to Medium Risk. It has the capability of generating the text in multiple languages which contributes to it's effectiveness in spreading. Avoid all email attachments ending with EXE, COM, and PIF (which we should always do). This new worm is network aware and can spread on a Peer-to-peer basis to open file shares on PCs and Servers.

Zafi.b - MEDIUM RISK, aka Erkez.b
http://secunia.com/virus_information/9988/
http://www3.ca.com/securityadvisor/virusin...s.aspx?id=39333
http://vil.nai.com/vil/content/v_126242.htm
http://www.sarc.com/avcenter/venc/data/w32.erkez.b@mm.html
http://times.hankooki.com/lpage/tech/20040...20092511800.htm

This is a mass-mailing worm that constructs messages using its own SMTP engine, spoofing the From: address. It also attempts to propagate via P2P, via copying itself to folders on the local system (containing 'share' or 'upload' in the folder name).

EMAIL Format to block or avoid

From: The "From:" field of the email is spoofed.
Subject: <Blank>
Attachment: <random file name with .com, .exe, or .pif as extension>
Message: <random and different languages>


Ther Mul

 

Hi The Mul,

Maybe this is more for the "Virus and Worm" forum-section:
https://www.wilderssecurity.com/forumdisplay.php?f=38