Fizzer Removal Tool

Fizzer Removal Tool is a small but powerful utility that can help you clean your PC of the Win32.Fizzer.A@mm infection.

This mass mailer can spread through e-mail and Kazaa, has backdoor and keylogger abilities. The backdoor component uses Mirc and AIM (AOL Instant Messenger) thus allowing the author to issue commands on the victim's computer.

Usually, this virus arrives via e-mails that have attachments with the next extensions: EXE, PIF, COM, SCR.

Once run, the virus attempts to terminate processes whose names contain: NAV, SCAN, AVP, TASKM, VIRUS, F-PROT, VSHW, ANTIV, VSS, NMAIN

It creates SparkyMutex mutex in order to allow only one instance of itself in memory.

It harvests e-mail addresses from the Windows Address Book, Cookies, Internet Temporary Files folder, and also My Documents folder, and stores them in data1-2.cab file in Windows folder. It uses the default configured MAPI program to send itself to the harvested e-mail addresses.

The mass-mailer uses a specific configuratin file, in which it stores all its information. The virus uses an engine, Sparky, that could be updated (originally via an internet address).

The keylogger component (iservc.dll) will save captured keystrokes to file iservc.klg or to a backup file, wavckb.dlb, located in Windows folder.

It has backdoor abilities, and attempts to randomly connect to an irc server, to a password protected channel, (using a random nick) where the author can issue commands on the infected computer.