Nasty New Year Virus

By Jim Freund | Dec 20, 2001 | Print this Page

The Payload
Now for the nasties. There appear to be number of variants of the worm itself. In all circumstances, Reeezak copies itself to the Windows directory under the name CHRISTMAS.EXE. Different variants will do some of the following:

A process called sm56hlpr is created, and the keyboard is blocked.

As is always the case with mass-mailing worms, Reeezak will attempt to propagate by mailing itself to all entries in the Outlook or Outlook Express address book.

These entries may be made to the Windows registry:

This entry is assigned the CHRISTMAS.EXE value, pointing to the location of the file containing the worm. As a result, the malicious program will run each time Windows is launched.
   ComputerName/ComputerName = "ZaCker"
Through this entry, the worm changes the name of the computer to ZaCker.
  HKEY_CURRENT_USER/Software/Microsoft/Internet Explorer/Main/
   Start page =
This modifies the Internet Explorer start page, and will send your browser to a really nasty sitewhich will try to exploit a vulnerability in IE and run a Visual Basic Script on the infected computer that will attempt to delete significant portions of the Windows operating system.

If Reeezak is run on a Windows NT system, it will spawn a series of processes and title bars called Christmas until it uses up the computer's memory.

Some reports have been filed that the program will also try to exploit mIRC (as Goner did) and shared network drives, particularly peer-to-peer shared folders.

To manually remove this worm, restart the computer in Safe mode. hen reverse the changes that the worm made to the registry, look for any files added to the WINDOWS and/or SYSTEM32 directories, restart the computer, reinstall your preferred anti-virus software, and run a complete scan and cleansing.

This is a new virus, and therefore you should make sure you're absolutely up-to-date with all signature files for your anti-virus software and security patches for Outlook. Educate your users about attachments and files spread through their shared folders, and that mIRC may become infected. Never allow Outlook or Outlook Express to automatically launch attachments.

Jim Freund is the Managing Editor of CrossNodes.