NWA-PCUG Newsletter Article, July 2003
Watch out for FIZZER
Another Dangerous Computer Worm
by Ira Wilsker
ira-wilsker@apcug.org
(click to email author)


The Fizzer worm, one of hundreds of newly created computer viruses and worms may reach endemic proportions if more of us do not protect our computers from its potentially damaging payload. Fizzer was first detected by the major antivirus and cyberthreat services on May 8. As I type this, one of the major email filtering services, MessageLabs, has reclassified Fizzer to “high-level alert status”, as it is currently infecting one of every 312 emails. Other services are showing that as many as 3 percent of all PCs are already infected with Fizzer. Email is not the only source of Fizzer infection, as it can also be transmitted by AOL Instant Messenger (AIM), and across networks from computer to computer. Many of the documented cases of infection came from file sharing networks, predominately the KaZaA service.

One of the reasons why Fizzer is so dangerous is that it has adopted the tactic used by many of its predecessors, such as the Klez, Bugbear, and Yaha viruses and worms, where it immediately disables any antivirus and firewall protection installed on the infected computer. It is also polymorphic, in that the code can mutate, generating different digital signatures possibly capable of sneaking by recently updated antivirus software. Fizzer is also capable of “dropping” varying code on infected computers, causing a variety of problems. Some antivirus publishers have found that some of the malicious code is itself “buggy”, and capable of crashing a computer, which although damaging, was not the original intent of the code.

Once a computer is infected, the worm replicates itself by sending out copies of its mutating-self using a variety of resources likely on the computer. It can send copies of itself using its own integral “SMTP” or email engine, without the need to load whatever email software is utilized on the computer. Fizzer can harvest email addresses and other contact information from the Outlook or Outlook Express contacts list, Windows Address Book (WAB), almost any email addresses found on the computer, as well as from IRC, AOL-IM, KaZaA, and other resources. In addition to replicating itself to all of the email addresses found, it also has the capability of updating itself, changing its code and payload, whenever the computer is connected to the net.

If arriving at the targeted computer via email, it will, again similar to its predecessors, arrive with a “spoofed” or forged “From:” address, concealing the real source of the infection. Since the real sender is difficult to identify, those his computer is infecting will not likely inform the owner of the infected computer. The subject line and message are variable, as are the names and file types of the dangerous payload. The payload will likely carry any one of the common executable file extensions such as .exe, .com, .scr, and .pif. The filenames selected by Fizzer are often the names of legitimate files found on the infected computer. The message bearing the payload may also appear as a “FWD:” (forwarded message) from an acquaintance, as the worm may hijack both the “TO:” and “FROM:” addresses from the infected address book; this is yet another example of how human engineering is utilized to trick a victim into opening or activating the payload. Some of the subject lines reported by the antivirus companies also appear to contain religious messages. One possible hint of an infected email is that many of the messages are sent in German, or use German phrases, as well as English.

Once activated, Fizzer checks for files installed on the computer, and if vulnerable, installs multiple copies of itself to the Windows directory, using a variety of filenames. It also installs utilities to monitor and intercept the software running on the computer, and enables “keylogging”, where keystrokes typed by the user can be stored, possibly enabling the theft of passwords, account numbers, email addresses, credit card numbers, and other personally sensitive information. Since Fizzer can access the net and file sharing networks, it is capable of sending this information to a large number of destinations. The antivirus publisher McAfee has detected literally hundreds of possible locations that may receive this stolen data. One method used by Fizzer to disseminate the victims’ information is to connect online to an IRC or AOL-IM server, remotely join a chat, and post the information; it is not known if these chats are being monitored to capture this information, or to simply provide a means of randomly disclosing what is stolen from the victim. Fizzer can also connect itself to KaZaA and make the information available to unknown individuals by simple download.

Most of the antivirus websites have a free utility available for download, which can detect and kill most versions of Fizzer. Please do not totally depend on the antivirus software already installed on your computer to protect against Fizzer, because since it is polymorphic, and may have deactivated the antivirus software if the infection preceded the appropriate antivirus update, many users have infected computers and are unaware of it, despite the fact that they believe they are protected. I strongly recommend that one of the free online virus scans be run frequently to detect and kill anything that may have slipped by the antivirus software installed on the computer. Many of these free utilities are listed on my website at http://www.mycomputershow.com.

Free online scans are available at http://www.housecall.antivirus.com, http://www.pandasecurity.com, http://www.ravantivirus.com, http://www.bitdefender.com, and http://www.mcafee.com. If one of these scans finds that Fizzer is installed, it may be necessary to reinstall your antivirus software and firewall after Fizzer is killed. Again this reiterates the absolute need to have antivirus software installed, running, and updated very frequently.

There is no restriction against any non-profit group using the article as long as it is kept in context, with proper credit given to the author. This article is brought to you by the Editorial Committee of the Association of Personal Computer User Groups (APCUG), an international organization of which this group is a member.

Click here to return to top



==================================================================