Worm surprises as holiday e-mail

December 19, 2001

The Reeezak worm enters a computer as an e-mail message in Microsoft Outlook with a subject line "Happy New Year" and an attachment--"Christmas.exe"--which a recipient may think is a Christmas card.

The worm can disable selective keys on the infected computer's keyboard and delete all the files found in the Windows System Directory, rendering the computer inoperable, said Ian Hameroff, director of antivirus solutions for Computer Associates International.

Because the worm, a self-propagating virus, sends itself to every e-mail in an address book, recipients are more likely to open the attachment because it appears to come from a recognized source.

"If it were launched in June, many people would be suspicious of it, but since it is the holidays and you may be expecting to receive such greetings from friends and colleagues you may trust this and receive a gift you aren't exactly expecting," Hameroff said.

Hameroff recommends recipients of e-mail messages that come with unsolicited attachments call the sender to verify they sent it before opening the attachment and possibly activating a virus.

Reeezak first appeared in the United Kingdom and other parts of Europe and was detected later in the United States, where Hameroff guessed thousands of computers have been infected.

Computer Associates rated the worm a medium to high risk.

Symantec's Security Response unit had not yet rated it Wednesday afternoon and McAfee.com had it at a low risk threat.

A message in the body of the Reeezak e-mail reads (with the first word misspelled):

"Hii

I can't describe my feelings

But all i can say is

Happy New Year :)

bye"

Other names for the worm are: W32.Zacker.C+mm and W32.Maldal.C+mm.