Computer worm fails to fizzle out

[Althalus]

13:07 13 May 03

Infections by a computer worm that travels via both email and file-sharing networks grew on Tuesday, according to anti-virus companies.

"I'm surprised because we expected it to die down," says Carole Theriault, consultant with UK anti-virus company Sophos. Computer viruses usually fizzle out quickly if they gain widespread publicity, as users gain awareness. "But we're actually seeing more activity today," she says.

The worm, called Fizzer, contains tools that could be used to hijack a computer. However, early indications suggest that the level of infections is not high enough to cause a global epidemic.

Fizzer is most likely to arrive attached to an email message seemingly sent by a friend or acquaintance. Once unwittingly activated, the program will then forward itself on to everyone in the recipient's email address book, using one of a number of possible subject lines.

Sinister tasks

If the infected machine is running the popular file-sharing client Kazaa, Fizzer will also copy itself to the Kazaa sharing folder as a randomly disguised file. Other Kazaa users could then download the worm and infect their own machine.

The worm carries a payload capable of more sinister tasks. It attempts to deactivate anti-virus software and record passwords using a key-logging program. A bundled backdoor application provides a means for an attacker to remotely control the target machine using Internet Relay Chat (IRC).

Despite Fizzer's continued growth, early statistics suggest that the worm will not become a major worldwide phenomenon. At 1900 GMT on Monday anti-virus company Symantec had received 150 infection reports from individual users and 26 reports from corporate customers.

Blended threat

Although the number of unreported infections will be far higher, Kevin Haley, group product manager at Symantec, says the current level of infections does not indicate a significant outbreak.

Fizzer's versatility makes it "a classic blended threat", Haley told New Scientist. "But it is not on the scale of other mass mailer worms."

Theriault says as well as using recently updated anti-virus software, companies could block all executable email attachments and stop IRC communications at the firewall. The worm only infects and spreads between computers running Microsoft's Windows operating systems.

New Scientist