W32/Fizzer is an email worm. This worm will infect Windows systems. The worm spreads through email, shared network drives, IRC and KaZaA P2P software. It also contains a backdoor trojan component that contains key-logging capability.

The worm arrives with a subject, which is a combination of words randomly chosen by it. The names of the infected attachments of the worm are randomly generated from the words contained in a list of its own.

The extension of the infected attachment can be any one of these .com, .exe, .pif, .scr. Upon execution of the attachment, the worm copies itself as:

iservc.dll
ProgOp.exe
initbak.dat
iservc.exe

to the Windows folder. It modifies registry at the following location to run itself at the startup.

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

The worm tries to collect all the email addresses found under Microsoft Outlook, Windows address book. The worm tries to mail itself to these email addresses using its own SMTP engine. The worm also tries to generate email addresses using a set of formulae.

The backdoor component of the worm tries to connect to the IRC channels and executes in the background. The worm also logs all the key-strokes to a file ISERVC.KLG, under Windows folder in an encrypted format. It also attempts to terminate few anti-virus softwares.

This worm first appeared on 8th May 2003.

Other names of W32/Fizzer worm:

This worm is also known as WORM_FIZZER.A, W32/Fizzer@MM, W32/Fizzer-A