6/11: W32/Zafi-B Sets Registry Entry
June 11, 2004

W32/Zafi-B is a peer-to-peer (P2P) and email worm that will copy itself to the Windows system folder as a randomly named EXE file and set the following registry entry to ensure that it will be run on system restart.

The following registry branch will also be created: HKLM\Software\Microsoft\Windows\CurrentVersion\Run\_Hazafibb = \ The following registry branch will also be created: HKLM\Software\Microsoft\_Hazafibb\ This registry branch will have value names consisting of two alphanumeric characters. This worm will test for the presence of an Internet connection by attempting to connect to www.google.com or www.microsoft.com. W32/Zafi-B collects email addresses from files which have the following extensions: HTM, WAB, TXT, DBX, TBB, ASP, PHP, SHT, ADB, MBX, EML and PMR. More information is at Sophos page.