You are here: Antivirus & Antispyware: Merry Christmas Virus

Merry Christmas Virus

Thursday, December 20th, 2007

Threat: Merry Christmas Virus
Discovered: December 15, 2004
Also known as: W32.Zafi.D, Xmas Virus
Type: Email worm

The Merry Christmas virus is an email worm that started to emerge before Christmas of 2004. The worm spread via electronic mail as a small, executable file with a variety of names and extensions. The worm propagated by copying itself onto local and networked drives, as well as emailing itself as an attachment to any addresses it could harvest from the address book and files stored on the infected machine.

When executed, an infected file copies itself into the Windows system directory and registry disguised with the name “NortonUpdate.exe.” The registry entry ensures that a copy of the worm is launched each time the infected machine is booted. It also creates files in the system directory that are used to store the email addresses harvested from the Windows address book, text documents, web pages, emails and mailboxes stored on the machine.

Infected email messages are sent in a variety of languages depending on the geographical location of the recipient’s domain name. The messages arrive with the subject “Merry Christmas!” and body “Happy Holidays!” in the corresponding language. The attachment has the name “postcard” in the particular language, followed by a long string of random characters that obscure an executable extension.

The seemingly harmless text lures victims into downloading the attached file that is disguised as a holiday postcard.

Besides replicating furiously, the worm also opens a backdoor on infected systems that provides unauthorized remote access by malicious parties. This allows attackers full access to any stored personal information, along with the ability to download and launch files remotely on a victim’s machine. Furthermore, the worm bypasses installed security measures such as firewall or antivirus programs by overwriting their application files with an infected executable. Thus, while an email message may appear harmless, even one execution of an infected attachment can cause significant damage that is difficult to reverse.

McAfee Virus Prevention & Protection

McAfee VirusScan Plus provides proactive protection that helps you avoid online attacks and protects what you and your family value from hackers, identity thieves and other online dangers. It halts malicious activity before it can target your identity, put your children at risk, and threaten your online safety. McAfee VirusScan Plus integrates sophisticated security technologies to prevent multi-pronged attacks.

Stops Viruses. Automatically blocks, cleans and removes viruses so you can surf the Web safely. Cleans files, emails, internet downloads and instant messaging attachments, and prevents the spread of viruses to co-workers, friends and family.
Blocks Spyware. McAfee also blocks spyware before it can install on your computer, and removes existing spyware. Secure your identity and privacy – while also keeping your PC from getting clogged with unnecessary programs and files.
Always On, Always Protecting. 24/7 virus and threat protection from McAfee® Avert® Labs continuously monitors worldwide virus activities and provides rapid anti-virus protection and removal solutions.
Always Upgrading, Always Updating. Daily updates are installed automatically. When new versions are available, you get them automatically at no charge, ensuring that you always have up-to-date protection.

Special Limited Time Offer: Download McAfee VirusScan Plus 2008 – Only $19.95!

While you may have remained untouched in the past, in reality, without advanced security, you’re leaving everything right out in the open! So why risk exposing your credit card information, email address book or the general health of your PC for even one more day? Download the protection you need with McAfee VirusScan, an easy-to-use antivirus solution providing advanced protection from viruses, worms, Trojans and more.