AGT & F-Secure issues warning to computer users in the region

Due to the worm's rapid speed of spread, it was raised to Radar level 2 alert on Sunday, june 13th. The worm spreads by email in variable PIF.-, .EXE-, or COM -attachments. It also sends the messages in several different languages; e.g. in English, Italian, Spanish, Russian, Swedish, German or Finnish.

Like a typical email worm, Zafi.B also gathers addresses from the users address books and then spreads by sending itself to those addresses. When the worm activates, it copies itself to the Windows System Directory with a random .DLL and random .EXE name. After this the worm scans through all directories in the system and replicates as either 'winamp 7.0 full_install.exe' or 'Total Commander 7.0 full_install.exe' to all folders that contain 'share' or 'upload' in their name. In addition to this, it terminates all applications that have 'firewall' or 'virus' in their filename.

In a strategic partnership with F-Secure, for the Middle East, AGT focuses on providing Arab organizations with F-Secure's award-winning security solutions, including antivirus, desktop firewall with intrusion prevention and network encryption.

The alliance with F-Secure significantly enhances AGT's leading market position in the Middle East. "It is fortuitous that we have these solutions available at a time when the challenges facing the Arab organisations are increasing," says Anas Chbib, Managing Director of AGT.

"This worm is tricky, as it has a feature that can close down firewalls and antivirus programs in order to help itself spread further", Mikael Albrecht, the product Manager at F-Secure explains. "But that's not all. Another interesting thing about this worm is that the infected messages come in many different languages. As most of the widely spread worms use only English, this feature may confuse the user to open the message - and the worm spreads on", he continues.

As an example an email message sent by Zafi.B may look like this:

Sender: Jennifer
Subject: eYou`ve got 1 VoiceMessage!
Attachment: "link.voicemessage.com.listen.index.php1Ab2c.pif"

Message body:

Dear Customer!
You`ve got 1 VoiceMessage from voicemessage.com website!
You can listen your Virtual VoiceMessage at the following link: http://virt.voicemessage.com/index.listen.php2=35affv
or by clicking the attached link.
Send VoiceMessage! Try our new virtual VoiceMessage Empire! Best regards: SNAF.Team (R).

Examples of the messages in other languages as well as more detailed technical description of the Zafi.B worm are available in the F-Secure Virus Description Database at http://www.f-secure.com/v-descs/zafi_b.shtml

F-Secure Anti-Virus can detect and remove the Zafi.B worm. F-Secure Anti-Virus can be downloaded from http://www.f-secure.com.