PRESS RELEASE
Oslo, Norway, 14 June 2004

A new email worm Zafi.B detected last week is spreading in rapidly growing numbers this morning, and has already been reported from many countries.

The worm has been named W32/Zafi.B. It spreads as an attachment to emails and through P2P networks with multi language subject line, body and attachment. The content appears in a multi language format (for example in English, German, Italian and several of the Nordic language).

The email message can appear as (example):
To: Jennifer
Subject: Don’t worry, be happy!
Attachment: www.ecard.com.funny.picture.index.nude.php356.pif
Message:
Hi Honey!
I’m in hurry, but i still love ya...
(as you can see on the picture)
Bye - Bye:

For all users of Norman Virus Control or Norman Internet Control this worm is detected and removed using definition files from 11 June 2004 2004 and newer.
Norman’s SandBox detected the worm without signature updates as “[SANDBOX] infected with unknown worm - W32/P2PWorm".

A complete list of details is found on the Norman web site http://www.norman.com  

Contact information

Steinar Wigtil, Director of R&D, Norman Data Defense Systems ASA,
Telephone +47 67 10 97 29, mobile phone +47 41 53 97 29
Audun Lødmel, Marketing, Norman Data Defense Systems ASA,
Telephone +47 67 10 97 79, mobile phone +47 93 44 65 31