'Reeezak' worm offers holiday jeers

December 19, 2001

The worm, called "Reeezak," appears in inboxes with the subject line "Hi," and a message that reads "I can't describe my feelings, but all I can say is Happy New Year :-) Bye," according to Ian Hameroff, business manager for security solutions at CA. An attachment called "Christmas.exe" accompanies the e-mail and appears to be a Macromedia Inc. Flash animation, Hameroff said.

When the attachment is double-clicked, the worm sends itself to all addresses listed in the user's address book and also tries to delete all the files in the Windows directory as well as disabling some keys on the keyboard, he said. The worm only affects users of Microsoft Corp.'s Outlook or Outlook Express e-mail clients, according to Hameroff.

Though the worm was initially spreading mainly in Europe, as the business day unfolded in the U.S., copies of it began to appear elsewhere in corporate and personal mailboxes.

Other antivirus companies report different effects from double-clicking on Reeezak, however. Symantec Corp., in a virus alert posted on its Web site, says that the worm also tries to spread using the mIRC (Internet Relay Chat) application or through shared folders. Symantec also reports that the worm attempts to delete antivirus programs.

To avoid infection, users are cautioned not to open unexpected attachments and companies should block many e-mail attachments, including .exe files. Users should also check with their antivirus vendor for updated virus protection.