Widespread Zafi-B computer worm calls for death penalty, says Sophos

June 14, 2004 Sophos Press Release

Experts at Sophos have warned computer users about an increase in the number of reports of the W32/Zafi-B worm.

The Zafi-B worm, which first appeared on Friday 11 June, spreads itself by peer-to-peer filesharing systems and email using a wide variety of different languages.

The Zafi-B worm can display a message box on screen containing the following Hungarian text:

A hajlektalanok elhelyezeset, a bunteto torvenyek szigoritasat, es a HALALBUNTETES MEGSZAVAZASAT koveteljuk a kormanytol, a novekvo bunozes ellen! 2004, jun, Pécs,(SNAF Team).

The English translation is:

We demand that the government accomodates the homeless, tightens up the penal code and VOTES FOR THE DEATH PENALTY to cut down the increasing crime. Jun. 2004, Pécs (SNAF Team)

"The Zafi-B worm has accounted for over 60 per cent of the reports to Sophos's global network of monitoring stations over the last 24 hours, making it the most widespread email worm at the moment," said Graham Cluley, senior technology consultant for Sophos. "All computer users should ensure their defences are in place against the latest viruses. That not only includes regular anti-virus updates to protect against emerging threats, but also running a policy at your email gateway to block unwanted executable code from entering your business."

The Zafi-B worm is believed to have been written in Hungary, but can send itself via email using a variety of languages. Its predecessor, W32/Zafi-A, displayed a message calling for Hungarian patriotism.

Customers using Sophos products were automatically protected against the Zafi-B worm at their next scheduled update.