Widespread Zafi-B computer worm calls for death penalty, says Sophos

Sophos Press Release

Experts at Sophos have warned computer users about an increase in the number of reports of the W32/Zafi-B worm.

The Zafi-B worm, which first appeared on Friday 11 June, spreads itself by peer-to-peer filesharing systems and email using a wide variety of different languages.

The Zafi-B worm can display a message box on screen containing the following Hungarian text:

A hajlektalanok elhelyezeset, a bunteto torvenyek szigoritasat, es a HALALBUNTETES MEGSZAVAZASAT koveteljuk a kormanytol, a novekvo bunozes ellen! 2004, jun, Pécs,(SNAF Team).

The English translation is:

We demand that the government accomodates the homeless, tightens up the penal code and VOTES FOR THE DEATH PENALTY to cut down the increasing crime. Jun. 2004, Pécs (SNAF Team)

"The Zafi-B worm has accounted for over 60 per cent of the reports to Sophos's global network of monitoring stations over the last 24 hours, making it the most widespread email worm at the moment," said Graham Cluley, senior technology consultant for Sophos. "All computer users should ensure their defences are in place against the latest viruses. That not only includes regular anti-virus updates to protect against emerging threats, but also running a policy at your email gateway to block unwanted executable code from entering your business."

The Zafi-B worm is believed to have been written in Hungary, but can send itself via email using a variety of languages. Its predecessor, W32/Zafi-A, displayed a message calling for Hungarian patriotism.

Customers using Sophos products were automatically protected against the Zafi-B worm at their next scheduled update.

More than 100 million users in 150 countries rely on Sophos’ complete security solutions as the best protection against complex threats and data loss. Simple to deploy, manage, and use, Sophos’ award-winning encryption, endpoint security, web, email, mobile and network security solutions are backed by SophosLabs - a global network of threat intelligence centers. Sophos is headquartered in Oxford, U.K., and is publicly traded on the London Stock Exchange under the symbol “SOPH.” More information is available at www.sophos.com/company.