Fizzer E-mail Worm is Spreading at an Alarming Rate
F-Secure is raising the alert to the highest level as Fizzer becomes one of the most widespread viruses currently in circulation.
Fizzer was first seen on Thursday, 8th of May. Since then it has been located from several countries worldwide and it continues to spread at a quick rate. The largest infections seem to be in Asia, especially in China and Hong Kong, but both Europe and USA are hit, too.
Fizzer is a Windows worm, spreading through e-mail and the Kazaa peer-to-peer file sharing program. The worm is very complex and misuses the infected computers in several ways. Fizzer will also attempt to attack several antivirus programs and try to remove them, leaving the infected machines vulnerable to infections from other malware as well.
“This is one of the more complicated worms we’ve seen”, comments Mikko Hypponen, Manager of Anti-Virus Research at F-Secure. “The worm is 200kB of code spaghetti, containing backdoors, code droppers, attack agents, key loggers and even a small web server!”
The Fizzer worm spreads via e-mail as an attachment. The e-mails sent by the worm vary a lot, as do the names of the attachments, but they always have extensions of .EXE, .PIF, .SCR or .COM. These e-mails are sent to both random addresses as well as to addresses found in the infected computer.
“Fizzer actually creates random e-mail addresses and targets them”, explains Hypponen. “This is done by picking random names and numbers and creating addresses belonging to large services such as Hotmail – these addresses might look like BOB246@MSN.COM or JACK555@YAHOO.COM”.
Fizzer tries to terminate various processes in the memory of an infected computer. This includes processes used by several antivirus products. However, the worm does not affect F-Secure Anti-Virus. “As this worm is already widespread, there must now be scores of computers in the internet without any anti-virus protection – because Fizzer has removed it”, comments Hypponen.
The worm will install a backdoor in all infected systems, allowing the virus writer to control them – even to remotely look at their monitors. The infected computers can also be used to launch distributed denial-of-service attacks against any Internet-connected machines at any time.
A detailed technical description of the worm as well as screenshots are available in the F-Secure Virus Description Database at
http://www.f-secure.com/v-descs/fizzer.shtml
F-Secure Anti-Virus can detect, stop and disinfect the Fizzer worm. F-Secure Anti-Virus can be downloaded from http://www.f-secure.com
About F-Secure Corporation
F-Secure Corporation is the leading provider of centrally managed security solutions for the mobile enterprise. The company’s award-winning products include antivirus, file encryption and network security solutions for major platforms from desktops to servers and from laptops to handhelds. Founded in 1988, F-Secure has been listed on the Helsinki Exchanges since November 1999. The company is headquartered in Helsinki, Finland, with the North American headquarters in San Jose, California, as well as offices in Germany, Sweden, Japan and the United Kingdom and regional offices in the USA. F-Secure is supported by a network of value added resellers and distributors in over 90 countries around the globe. Through licensing and distribution agreements, the company’s security applications are available for the products of the leading handheld equipment manufacturers, such as Nokia and HP.