Virus Warning: Navidad back in the wild

The Christmas worm which wreaked havoc two years ago is back - this time in a re-formatted file which remains undetectable by anti-virus software.

According to anti-virus experts MessageLabs, the Navidad worm is now the most active virus of the last 24 hours, with almost 2,000 instances spotted in the past 24 hours.

It first reared its ugly head in December 2000 but virus-writers have given the worm a new lease of life by re-formatting it into a different compression file.

Security experts are warning users to update their anti-virus software today as the old software can no-longer detect it.

MessageLabs said it has seen it 2,878 times since it was re-released on Thursday, the bulk of those sightings coming in the UK.

Mark Tosh, virus analyst for the MessageLabs, said: "This file has been compressed into a different format - essentially just packaged differently - so a lot of the scanners just didn't pick it up. It's been fooling a lot of people."

The new variant is called Navidad.E1-m, and is essentially exactly the same worm in a different format. It also has a non-functioning version of Magistr tagged on the end, adding to the confusion for anti-virus scanners.

It works through the now traditional mass-mailing method, taking email addresses from the victim's Outlook address book, so while it has no damaging payload, it can cause havoc by jamming up mail servers with thousands of messages.

Users should beware of emails with no subject line or body text containing an attachment entitled "emannuelle".

MessageLabs' Tosh said re-formatting is a very simple trick virus-writers can use to give a new lease of life to a virus and is a new trend causing increasing worry.

However Graham Cluley, virus expert for Sophos, said users should not worry too much about the new attack: "All the major anti-virus vendors are now detecting it, so users just need to ensure their anti-virus software is up-to-date."