Zafi-C mutant virus targets Google and Microsoft

Malicious code makes a goulash of Hungarian president's website

Robert Jaques, vnunet.com 28 Oct 2004

IT security experts have intercepted the latest mutant Zafi virus, dubbed Zafi-C, which targets the Google and Microsoft websites. It also attempts to knock out the website of the newly appointed Hungarian prime minister.

The Zafi-C worm (W32/Zafi-C) spreads via email using socially engineered subjects lines including 'Re: Hey buddy!' and 'Re: very sick little girl!' in an attempt to lure users into launching its malicious attachment.

If an unwitting user runs the attached file, the payload launches a distributed denial of service attack against the website of the prime minister of Hungary.

"Each new version of the Zafi worm we see has become more sophisticated and more malicious in its intent," said Graham Cluley, senior technology consultant for Sophos.

He added that the good news concerning the mutant virus was that initial monitoring indicated that it is not spreading at anything like the rate of its predecessor.

The previous version of the Zafi worm, Zafi-B, has continued to spread widely since June, with a message calling for the death penalty to be introduced in Hungary.

"The Hungarian author of the Zafi worm has been very successful in the past in spreading his viruses - all of which have a political message," said Cluley.

"Hopefully computer users are becoming more suspicious of unsolicited emails and are more vigilant about protecting their PCs from attack."

As well as the Zafi family of worms several other viruses have spread a political message, including the Quaters worm which launched a scathing attack on Tony Blair and attempted to knock the Downing Street website off the internet.

Further information about Zafi-C can be found here.

See also: