http://news.excite.com/tech/article/id/160312|technology|05-12-2003
14:46|reuters.htmlLOS ANGELES (Reuters) - A new and complex computer virus called "Fizzer" spread rapidly across the Internet on Monday, infecting computers across the world via e-mail and the file-swapping service Kazaa, computer security experts said.
Businesses in Asia were the first to report the attack, followed by reports of tens of thousands of infections in Europe, and experts were expecting more cases in North America.
"It first appeared last Thursday and started out rather slowly," said Vincent Gullotto, who heads up an anti-virus response Team at Network Associates Inc. in Beaverton, Oregon.
Fizzer was a complex virus that combined previously known tactics from other malicious viruses, Gullotto said.
There was no threat that Fizzer would cause widespread damage similar to the disruption caused by the "SQL Slammer" in January, which bogged down computer networks across the globe, Gullotto said.
Instead, Fizzer appears as an e-mail with an attention-grabbing subject line that is activated once a user opens an attached file.
From there, it infects the shared filed folder for Kazaa, the popular program that lets users swap songs and files anonymously over the Internet.
That allows Fizzer to spread to other computers, finds information for other contacts in Microsoft Corp.'s Outlook e-mail program and mail itself to more people.
British-based virus detection firm MessageLabs recorded 17,765 cases in 24 hours to 11:30 a.m. EDT. "We've upgraded it to high-risk just for the fact that we've seen so many in the last day," said Mark Toshack, a virus analyst at MessageLabs.
The worm also has the capability to disable computer users' anti-virus and firewall software, but is otherwise not a threat to users' personal files. The biggest headache was the extra traffic it generated, bogging down corporate networks.
"It sends an e-mail message with varying format to all the addresses found in the Windows Address Book and Microsoft Outlook," Japanese security firm Trend Micro said.
The worm arrives as a file attachment with a .EXE, .PIF, .COM, or .SCR extension.
Other security software makers issued similar warnings through their Web sites, including U.S. firm Symantec Corp. and Finland's F-Secure. (Additional reporting by Carrie Lee in Hong Kong and Bernhard Warner in London)
