Kazaa makers say Fizzer can be stopped - News - Security

To print: Select File and then Print from your browser's menu

--------------------------------------------------------------
This story was printed from ZDNet Australia.
--------------------------------------------------------------

Kazaa makers say Fizzer can be stopped

By Staff writers, Special to ZDNet
May 19, 2003
URL: http://www.zdnet.com.au/news/security/soa/Kazaa-makers-say-Fizzer-can-be-stopped/0,130061744,120274623,00.htm

The maker of the file-sharing client Kazaa is advising users to protect themselves against the Fizzer virus by turning on the software's built-in anti-virus protection.

Kazaa has been fingered as one main avenue by which the Fizzer worm spread in Asia, although it also transmits itself via email and Internet Relay Chat (IRC).

According to Sharman Networks, the anti-virus function has since been updated to identify and stop Fizzer, and is free and is simple to use.

"Users of Kazaa Media Desktop are protected against Fizzer and other viruses, provided they have enabled the built-in BullGuard Lite antivirus feature which is updated with the most recent virus definitions," says Phil Morle, director of technology at Sharman Networks.

However BullGuard Lite operates only in Kazaa and does not protect against viruses if they enter via email, instant messaging, or downloads with other file-sharing networks, according to Sharman Networks.

Fizzer arrives in an e-mail with of a number of potential subject lines, including "So how are you?" "There is only one good, knowledge, and one evil, ignorance." "You must not show this to anyone." "Today is a good day to die." "Filth is a death." "Watchin' the game, having a bud." "Did you ever stop to think that viruses are good for the economy?"

Fizzer spreads in e-mail as an attachment with .exe, .pif, .scr and .com extensions.

When activated the worm sends itself to e-mail addresses stored in the infected PC's Windows and Outlook address books and drops into the Windows folder several files called initbak.dat, iservc.dll, iservc.exe and ProgOp.exe.

More than 40 percent of all Fizzer interceptions were in China, according to MessageLabs.

Silicon.com's Will Sturgeon contributed to this report.