New Christmas Card email worm spreading

Helsinki, Finland - December 14, 2004

Virus writers are honouring this Christmas with a new virus known as Zafi.D. This email worm spreads in emails that are written in several different languages based on the recipient. The Christmas greeting could be written in English, Italian, Spanish, Russian, Swedish and several other languages.

The message is a simple Christmas wish. Following text is an example of English message:

Sender: Pamela M.
Subject: Merry Christmas! Happy Hollydays!

The infected attachment has an extension of .pif, .cmd, .bat, or .com file. When run, the virus displays a decoy error message saying "Error in packed file!". After this the virus spreads further and installs a backdoor that will allow the virus writer to take over the infected computer. The worms sends messages in the respective languages to the following country codes: .hu .sp .ru .dk .ro .se .no .fi .lt .pl .pt .de .nl .cz .fr .it .mx .at .es

�We have seen viruses that send fake Christmas cards almost every Christmas, says Mikko Hypp�nen, Director, Anti-Virus Research at F-Secure Corporation and continues �we recommend people to send traditional pen and paper Christmas cards instead�.

F-Secure Anti-Virus can detect and remove the Zafi.D variant. F-Secure Anti-Virus can be downloaded from <http://www.f-secure.com>

Based on independent research by AV.Test.org and Messagelabs F-Secure detects new threats faster compared to other major antivirus vendors. F-Secure also updates customers more regularily than other major antivirus vendors. Between January and August 2004, F-Secure sent out an average of 48 updates per month, which is 50% more than Symantec, almost three times as many as Trend and almost five times as many as McAfee. For the 45 major malware epidemics during 2004, F-Secure customers received their updates on average six hours after the first sample was detected, while, on average, Trend customers were updated ten hours, McAfee customers 14 hours and Symantec customers 16 hours after the first sample. (Source AV-Test.org)

To communicate breaking news fast F-Secure initiated a weblog to provide customers and the media with the latest factual information about viruses, worms, security hacks, and the people behind them. Comments and analyses are updated continually by Mikko Hypponen and the rest of F-Secure's security research team, and postings often include screen shots and images of actual viruses and malware code.

F-Secure has issued its traditional year-end wrap-up release, which can be read at: http://www.f-secure.com/2004/

About F-Secure

F-Secure Corporation protects individuals and businesses against computer viruses and other threats coming through the Internet or mobile networks. Our award-winning solutions include antivirus, desktop firewall with intrusion prevention. During 2004 F-Secure Corporation has been the fastest growing company globally in the antivirus and intrusion prevention industry with more than 50% growth of revenues during the first 9 months in 2004. Our key strength is the speed of response to new threats. For businesses our solutions feature centralized management. Founded in 1988, F-Secure has been listed on the Helsinki Exchanges since 1999. We have our headquarters in Helsinki, Finland, and offices in USA, France, Germany, Italy, Sweden, the United Kingdom and Japan. F-Secure is supported by a global ecosystem of value added resellers and distributors in over 50 countries. F-Secure protection is also available through major Internet Service Providers, such as Deutsche Telekom, France Telecom and Charter Communications.

For more information, please contact:

F-Secure Corporation
Mr. Mikko Hypponen, Director, Anti-Virus Research
PL 24
FIN-00181 Helsinki
Tel +358 9 2520 5513
Fax +358 9 2520 5001
E-mail: mikko.hypponen@f-secure.com