Oslo, 19 December 2001   

The Data Security Company Norman warns against a new mass mailer worm, W32/Maldal.C@mm. May be an especially fast spreading since it poses as Christmas and New Year greetings.

General characteristics

• Type: Worm
• Alias: W32/Zacker.C, W32/Keyluc.C
• Spreading mechanism: Email
  • Email characteristics:
  • Subject: Happy New Year
  • Body: Hii I can't describe my feelings But all i can say is Happy New Year :) bye
  • Attachment: Christmas.exe
• Destructivity: High Risk

Additional description of malicious program

Type This is an email worm, which will attempt to send itself to all users in the Outlook address book.

Spreading mechanism When run, this worm will copy itself to the Windows directory under the name Christmas.exe. It will then set a number of registry keys - one to set ComputerName to "Zacker", one to set default home page to the authors page on Geocities, and another one to automatically run the worm from startup.

Further comments The analysis is not complete. More information later.

Norman Virus Control with definitions files from December 19th or later detects this worm. Users are encouraged to update their Norman Virus Control protection to the most recent version.

More information on www.norman.com

For further information, please contact

Norman ASA, VP Marketing Bjørn A. Windfeldt, tel.+47 67 10 97 76, mob. +47 41 53 97 76