Experts Warn of Christmas Computer Worm

Dec. 19, 2001 -- Computer security experts warn a new holiday-themed computer virus is winding its way through the Internet today.

The worm, known by several names including W32.Zacker.C and W32.Maldal.C, is similar to the recent Goner worm in that it attacks computers that run Microsoft's Windows operating systems and Microsoft's Outlook e-mail program.

The new worm arrives in an e-mail with the subject line of "Happy New Year." The body of the message says: "Hii [sic] I can't describe my feelings. But all i [sic] can say is Happy New Year :) bye."

Attached to the e-mail is a file called "Christmas.exe" which contains the malicious computer programming. When an unsuspecting recipient opens the file, the computer displays a holiday greeting showing Santa Claus and a message that says: "From the heart, Happy new year [sic]!"

As the PC shows the electronic greeting, security experts say the worm sends copies of itself to all the e-mail addresses stored in the now-infected computer's Outlook program. The worm will then begin to delete files — including any anti-virus programs and possibly critical Windows components — from the computer's hard drive and install instructions to spread the worm every time the computer is restarted.

The worm also appears to spread through instant chat programs such as Microsoft's Messenger.

Will It Ruin Christmas?

Computer security experts don't yet know who crafted the malicious worm — or even if it will reach outbreak proportions of previous worms such as Nimda or Code Red.

Ian Hameroff, director of anti-virus solutions at Computer Associates, says the company has rated the threat as a medium- to high-risk threat. "We received several reports across Europe where several thousand computers have been infected," says Hameroff.

But April Goosetree of anti-virus maker McAfee.com said the company hasn't heard of any massive outbreak of the worm today either. The company rates the Zacker worm as a low-level threat.

Still, experts agree that the worm does have potential to rapidly spread given its apparently benign holiday greeting. "If this is spreading, it's because of the social aspect — because the file is named 'Christmas,' " says Jerry Freese, director of intelligence for Vigilinx, a computer security firm.

Most anti-virus software makers have already developed and released updates to their security programs to detect and remove the new worm.

Security experts advise users to update their anti-virus programs with these latest fixes to guard against the new worm. They also stress that suspicious files sent by e-mail shouldn't be opened without first checking with the sender.

"People are expecting holiday greetings [via e-mail]," says Computer Associates' Hameroff. "But this is one holiday gift that you won't like and you definitely won't be able to return it once it's opened."