The new "D" variant of the Zafi worm family is an advanced email attack that uses a well-design social engineering approach. It disquises itself as a holiday e-card which might be accidently opened by a lot of folks. McAfee, F-Secure, and other AV vendors have escalated this to MEDIUM RISK.
Zafi.D Worm - Holiday e-Card Risk (MEDIUM RISK)
http://vil.nai.com/vil/content/v_130371.htm
This new variant contains the following characteristics:
* contains its own SMTP engine to construct outgoing messages
* spoofs the From: address
* harvests target email addresses from the victim machine
* outgoing email message body is either in Hungarian or English
* displays p2p worm behaviour
* shuts down security services
Secunia has declared this new threat as MEDIUM RISK
http://secunia.com/virus_information/13874/
Full Version: Zafi.D Worm - Holiday e-Cards (MEDIUM RISK)
Published: December 14, 2004, 12:26 PM PST
By Matt Hines
Staff Writer, CNET News.com
Complete article
By Matt Hines
Staff Writer, CNET News.com
QUOTE
Zafi worm purports to be Christmas greeting
A new variant of the so-called Zafi worm surfaced Tuesday, disguised to appear as a Christmas greeting.
Multiple antivirus researchers reported the emergence of the latest iteration of Zafi, classified as W32/Zafi.D. Security software companies including McAfee and MessageLabs issued warnings detailing that the worm is being hidden in e-mails that advertise themselves as holiday greetings.
According to MessageLabs, Zafi.D is already being attached to bulk e-mails using a variety of file names and extensions. By mid-morning Tuesday, the company said, it had intercepted over 25,000 copies of the virus.
..."Most at risk are home users who think that it's a Christmas card from somebody that they know...although it's actually from the virus sending it from a spoofed e-mail address,"...
A new variant of the so-called Zafi worm surfaced Tuesday, disguised to appear as a Christmas greeting.
Multiple antivirus researchers reported the emergence of the latest iteration of Zafi, classified as W32/Zafi.D. Security software companies including McAfee and MessageLabs issued warnings detailing that the worm is being hidden in e-mails that advertise themselves as holiday greetings.
According to MessageLabs, Zafi.D is already being attached to bulk e-mails using a variety of file names and extensions. By mid-morning Tuesday, the company said, it had intercepted over 25,000 copies of the virus.
..."Most at risk are home users who think that it's a Christmas card from somebody that they know...although it's actually from the virus sending it from a spoofed e-mail address,"...
Complete article
Another variant is: Erkez.D@mm
It can be in any language from sites mostly in Europe.
Description is here:
http://securityresponse.symantec.com/avcen...erkez.d@mm.html
Removal:
http://securityresponse.symantec.com/avcen...moval.tool.html
I got this from Woody's Office Watch newsletter today "Woody's EMAIL Essentials" <wow-robot@woodyswatch.com>
It can be in any language from sites mostly in Europe.
Description is here:
http://securityresponse.symantec.com/avcen...erkez.d@mm.html
Removal:
http://securityresponse.symantec.com/avcen...moval.tool.html
I got this from Woody's Office Watch newsletter today "Woody's EMAIL Essentials" <wow-robot@woodyswatch.com>
Thanks for the good additional sharing 
Actually at Secunia Zafi.D went High Risk
The new variants of ATAK also disquise themselves as holiday cards.
Actually at Secunia Zafi.D went High Risk
The new variants of ATAK also disquise themselves as holiday cards.
This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.