W32/Zar.A is a mass mailing worm. The worm will infect Windows systems and spreads through email.

The subject of the infected mail will be;

Tsunami Donation! Please help!

The body of the infected mail will be;

Please help us with your donation and view the attachment below! We need you!

The infected email carries the following attachment;

tsunami.exe

Upon execution of the infected attachment, the worm copies itself as crssr.exe, raz32.exe, tsunami.exe in the Windows folder.

The worm modifies registry at the following location to load itself during each startup.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run.

The worm attempts to perform a DoS attack on the site www.hacksector.de.

To propagate itself, the worm collects the email addresses from Microsoft Outlook Address Book. After this, using MAPI the worm mails itself to the collected addresses.

This worm first appeared on 18th January, 2005.

 Other names of W32/Zar.A Worm:

This Worm is also known as WORM_ZAR.A, W32.Zar.A@mm, W32/VBSun-A, W32/Zar@mm, W32/Zar.A.worm, Zar.A.