Virus Database

I-Worm.Fizzer

Description I-Worm.Fizzer

Fizzer is an Internet worm that spreads via e-mail messages and KaZaa shared directories. It also contains "backdoor" remote access features.
Installation
When the worm is launched, it creates the following files in the Windows directory:
iservc.exe (copy of the worm) initbak.dat (copy of the worm) ProgOp.exe (worm's component) iservc.dll (keylogger library used by the worm) iservc.klg (contains logged keystroke data)
The worm also writes a registry key to start itself automatically when Windows starts:
HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersionRun SystemInit=(Windows directory path)iservc.exe
Under Windows NT/2000/XP the worm is able to create a system service, but this ability is disabled by its author.
It also registers as a default handler for files with the ".TXT" extension - resulting in the worm being executed when such files are opened.
Replication: KaZaa
The worm copies itself to the KaZaa download directory with random filenames.
Replication: E-mail
The worm uses its own SMTP engine to send out its copies. The destination e-mail addresses are randomly generated or extracted from the Outlook and Windows address books.
Infected messages have various selected subjects, bodies, and attachment names. They are generated from several large string lists. For example:
Subject: Re: ;( Attachment: desktop.exe Body: you must not show this to anyoneall Subject: Re: I think you might find this amusing... Attachment: Logan6.exe Body: Let me know what you think of this... Subject: Fwd: why? Attachment: Taylor83.com Body: Today is a good day to die...
Backdoor routine: IRC
The worm contains a list of IRC channels it tries to connect to in order receive remote access commands from an attacker.
Backdoor routine: Other
The worm starts HTTP and telnet-like servers and binds them to pre-configured ports to provide remote access to the computer.
Other
The worm captures all keystrokes and writes them to the file named "iservc.klg" in the Windows directory. It also tries to download and install its updated version from a geocities user page. The worm tries to terminate processes that contain the following strings in their names:
ANTIV AVP F-PROT NAV NMAIN SCAN TASKM VIRUS VSHW VSS
Most options, like registry key names, IRC and SMTP server names, port numbers and action sequences are pre-configured in a special data file that is encrypted and stored in the worm EXE file's resources.

Check other viruses! Be aware! Use Antiviral Software

HappyNewYear.556

Description HappyNewYear.556

It is not a dangerous memory resident parasitic virus. It hooks INT 21h and writes itself to the end of COM files that are executed. Depending on the system time and date it decrypts and displays the message:
Happy New Year !

Hard.662

Description Hard.662

This is a very dangerous memory resident parasitic virus. It hooks INT 21h, and writes itself to the end of .COM files that are executed. On Monday, at 6 p.m., it displays the text:
It's a hard days night!

and then erases the 50 first sectors on all logical drives.

Home